Struct CorsConfig 

pub struct CorsConfig { /* private fields */ }

CORS policy for an AppBuilder. Defaults to strict: nothing is allowed until you opt in. Use Self::permissive for dev.

Implementations

impl CorsConfig

pub fn strict() -> Self

Empty allowlist — every cross-origin request is denied until you call .allow_origin(...) etc. The recommended starting point for production APIs.

pub fn permissive() -> Self

Mirror everything (origin, methods, headers) — convenient for dev and fully-public APIs. Credentials are turned off because the CORS spec forbids combining * origin with credentials.

pub fn allow_origin(self, origin: impl Into<String>) -> Self

Append an explicit origin to the allowlist. Repeat for each origin; switches off Any if a previous call set it.

pub fn allow_origins<I, S>(self, origins: I) -> Self

where I: IntoIterator<Item = S>, S: Into<String>,

Append several origins at once — the batch form of allow_origin. Accepts anything iterable of string-likes, so vec!["https://a", "https://b"], an array, or a Vec<String> all work. Switches off Any if it was set.

pub fn allow_any_origin(self) -> Self

Allow every origin (*). Mutually exclusive with allow_credentials(true); the builder panics at into_layer time if both are set.

pub fn allow_methods(self, methods: Vec<Method>) -> Self

Replace the allowed methods list. Default: the seven common HTTP verbs (GET/POST/PUT/PATCH/DELETE/HEAD/OPTIONS).

pub fn allow_any_method(self) -> Self

Allow any request method.

pub fn allow_headers(self, headers: Vec<HeaderName>) -> Self

Replace the allowed request headers list. Default: Content-Type and Authorization — enough for JSON APIs plus Bearer / Basic auth.

pub fn allow_any_header(self) -> Self

Allow any request header. Falls back to mirror-request when allow_credentials(true) is set, because the spec forbids * with credentials.

pub fn expose_headers(self, headers: Vec<HeaderName>) -> Self

Headers JavaScript on the calling origin is allowed to read off the response (beyond the CORS-safelisted ones). Default empty; add e.g. X-Total-Count if you publish that header for pagination.

pub fn allow_credentials(self, yes: bool) -> Self

Whether browsers should send cookies and Authorization on cross-origin requests. Off by default; switching it on forces the allowlist to use explicit origins (the CORS spec forbids * with credentials) and switches Any headers over to mirror-request.

pub fn max_age(self, duration: Duration) -> Self

Preflight (OPTIONS) cache TTL the browser is asked to honour. Default 1 hour; None omits the Access-Control- Max-Age header so browsers fall back to their own default.

pub fn no_max_age(self) -> Self

Disable the Access-Control-Max-Age header.

Trait Implementations

impl Clone for CorsConfig

fn clone(&self) -> CorsConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for CorsConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for CorsConfig

fn default() -> Self

Returns the “default value” for a type.