Struct tower_http::cors::CorsLayer

pub struct CorsLayer { /* private fields */ }

This is supported on crate feature cors only.

Layer that applies the Cors middleware which adds headers for CORS.

See the module docs for an example.

Implementations

impl CorsLayer

pub fn new() -> Self

Create a new CorsLayer.

This creates a restrictive configuration. Use the builder methods to customize the behavior.

pub fn permissive() -> Self

A very permissive configuration suitable for development:

• Credentials allowed.
• All request headers allowed.
• All methods allowed.
• All origins allowed.
• All headers exposed.
• Max age set to 1 hour.

Note this is not recommended for production use.

pub fn allow_credentials(self, allow_credentials: bool) -> Self

Set the Access-Control-Allow-Credentials header.

use tower_http::cors::CorsLayer;

let layer = CorsLayer::new().allow_credentials(true);

pub fn allow_headers<I>(self, headers: I) -> Self where
    I: Into<AnyOr<Vec<HeaderName>>>, 

Set the value of the Access-Control-Allow-Headers header.

use tower_http::cors::CorsLayer;
use http::header::{AUTHORIZATION, ACCEPT};

let layer = CorsLayer::new().allow_headers(vec![AUTHORIZATION, ACCEPT]);

All headers can be allowed with

use tower_http::cors::{CorsLayer, any};

let layer = CorsLayer::new().allow_headers(any());

Note that multiple calls to this method will override any previous calls.

Also note that Access-Control-Allow-Headers is required for requests that have Access-Control-Request-Headers.

pub fn max_age(self, max_age: Duration) -> Self

Set the value of the Access-Control-Max-Age header.

use tower_http::cors::CorsLayer;
use std::time::Duration;

let layer = CorsLayer::new().max_age(Duration::from_secs(60) * 10);

By default the header will not be set which disables caching and will require a preflight call for all requests.

Note that each browser has a maximum internal value that takes precedence when the Access-Control-Max-Age is greater. For more details see mdn.

pub fn allow_methods<T>(self, methods: T) -> Self where
    T: Into<AnyOr<Vec<Method>>>, 

Set the value of the Access-Control-Allow-Methods header.

use tower_http::cors::CorsLayer;
use http::Method;

let layer = CorsLayer::new().allow_methods(vec![Method::GET, Method::POST]);

All methods can be allowed with

use tower_http::cors::{CorsLayer, any};

let layer = CorsLayer::new().allow_methods(any());

Note that multiple calls to this method will override any previous calls.

pub fn allow_origin<T>(self, origin: T) -> Self where
    T: Into<AnyOr<Origin>>, 

Set the value of the Access-Control-Allow-Origin header.

use tower_http::cors::{CorsLayer, Origin};

let layer = CorsLayer::new().allow_origin(Origin::exact(
    "http://example.com".parse().unwrap(),
));

Multiple origins can be allowed with

use tower_http::cors::{CorsLayer, Origin};

let origins = vec![
    "http://example.com".parse().unwrap(),
    "http://api.example.com".parse().unwrap(),
];

let layer = CorsLayer::new().allow_origin(Origin::list(origins));

All origins can be allowed with

use tower_http::cors::{CorsLayer, any};

let layer = CorsLayer::new().allow_origin(any());

You can also use a closure

use tower_http::cors::{CorsLayer, Origin};
use http::{HeaderValue, request::Parts};

let layer = CorsLayer::new().allow_origin(
    Origin::predicate(|origin: &HeaderValue, _request_head: &Parts| {
        origin.as_bytes().ends_with(b".rust-lang.org")
    })
);

Note that multiple calls to this method will override any previous calls.

pub fn expose_headers<I>(self, headers: I) -> Self where
    I: Into<AnyOr<Vec<HeaderName>>>, 

Set the value of the Access-Control-Expose-Headers header.

use tower_http::cors::CorsLayer;
use http::header::CONTENT_ENCODING;

let layer = CorsLayer::new().expose_headers(vec![CONTENT_ENCODING]);

All headers can be allowed with

use tower_http::cors::{CorsLayer, any};

let layer = CorsLayer::new().expose_headers(any());

Note that multiple calls to this method will override any previous calls.

Trait Implementations

impl Clone for CorsLayer

fn clone(&self) -> CorsLayer

Returns a copy of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for CorsLayer

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for CorsLayer

fn default() -> Self

Returns the “default value” for a type.

impl<S> Layer<S> for CorsLayer

type Service = Cors<S>

The wrapped service

fn layer(&self, inner: S) -> Self::Service

Wrap the given service with the middleware, returning a new service that has been decorated with the middleware.