Struct Cors

Source

pub struct Cors { /* private fields */ }

Expand description

A CORS policy.

use web_net::Cors;

let api = Cors::new()
    .origin("https://app.example.com")
    .headers(&["content-type", "x-csrf-token"])
    .credentials()
    .max_age(600);

Implementations§

Source §

impl Cors

Source

pub fn new() -> Self

A policy that allows no origin yet.

use web_net::{App, Cors, get};

// A policy that allows no origin is refused at build.
let empty = App::builder().route(get("/api", |cx| cx.text(200, "[]")).cors(Cors::new())).build();
assert!(empty.is_err());

let app = App::builder()
    .route(get("/api", |cx| cx.text(200, "[]")).cors(Cors::new().origin("https://app.example.com")))
    .build()?;
let r = serve_net::testing::respond(&app, b"GET /api HTTP/1.1\r\nHost: localhost\r\nOrigin: https://app.example.com\r\n\r\n");
assert_eq!(r.header("access-control-allow-origin"), Some(&b"https://app.example.com"[..]));

Source

pub fn origin(self, origin: &str) -> Self

Allows an origin, exactly as browsers send it (https://app.example.com, with a port when it has one).

use web_net::{App, Cors, get};

let app = App::builder()
    .route(get("/api", |cx| cx.text(200, "[]")).cors(Cors::new().origin("https://app.example.com")))
    .build()?;
let from = |origin: &str| serve_net::testing::respond(&app, format!("GET /api HTTP/1.1\r\nHost: localhost\r\nOrigin: {origin}\r\n\r\n").as_bytes());
assert!(from("https://app.example.com").header("access-control-allow-origin").is_some());
assert!(from("https://other.example").header("access-control-allow-origin").is_none());

Source

pub fn any_origin(self) -> Self

Allows every origin (answered with *). Not with credentials: the build refuses that pair.

use web_net::{App, Cors, get};

let app = App::builder()
    .route(get("/api", |cx| cx.text(200, "[]")).cors(Cors::new().any_origin()))
    .build()?;
let r = serve_net::testing::respond(&app, b"GET /api HTTP/1.1\r\nHost: localhost\r\nOrigin: https://app.example.com\r\n\r\n");
assert_eq!(r.header("access-control-allow-origin"), Some(&b"*"[..]));

Source

pub fn headers(self, names: &[&str]) -> Self

Request fields a cross-origin request may send beyond the simple ones (content-type, x-csrf-token).

use web_net::{App, Cors, get};

let app = App::builder()
    .route(get("/api", |cx| cx.text(200, "[]")).cors(Cors::new().origin("https://app.example.com").headers(&["x-csrf-token"])))
    .build()?;
let r = serve_net::testing::respond(&app, b"OPTIONS /api HTTP/1.1\r\nHost: localhost\r\nOrigin: https://app.example.com\r\nAccess-Control-Request-Method: GET\r\nAccess-Control-Request-Headers: x-csrf-token\r\n\r\n");
assert_eq!(r.header("access-control-allow-headers"), Some(&b"x-csrf-token"[..]));

Source

pub fn expose(self, names: &[&str]) -> Self

Reply fields a cross-origin script may read beyond the simple ones.

use web_net::{App, Cors, get};

let app = App::builder()
    .route(get("/api", |cx| cx.text(200, "[]")).cors(Cors::new().origin("https://app.example.com").expose(&["x-total"])))
    .build()?;
let r = serve_net::testing::respond(&app, b"GET /api HTTP/1.1\r\nHost: localhost\r\nOrigin: https://app.example.com\r\n\r\n");
assert_eq!(r.header("access-control-expose-headers"), Some(&b"x-total"[..]));

Source

pub fn credentials(self) -> Self

Cross-origin requests may carry cookies.

use web_net::{App, Cors, get};

let app = App::builder()
    .route(get("/api", |cx| cx.text(200, "[]")).cors(Cors::new().origin("https://app.example.com").credentials()))
    .build()?;
let r = serve_net::testing::respond(&app, b"GET /api HTTP/1.1\r\nHost: localhost\r\nOrigin: https://app.example.com\r\n\r\n");
assert_eq!(r.header("access-control-allow-credentials"), Some(&b"true"[..]));

// Any origin with credentials is refused at build.
let open = App::builder().route(get("/api", |cx| cx.text(200, "[]")).cors(Cors::new().any_origin().credentials()));
assert!(open.build().is_err());

Source

pub fn max_age(self, seconds: u32) -> Self

How long a browser may keep a preflight’s answer (default 300 s).

use web_net::{App, Cors, get};

let app = App::builder()
    .route(get("/api", |cx| cx.text(200, "[]")).cors(Cors::new().origin("https://app.example.com").headers(&["x-csrf-token"]).max_age(600)))
    .build()?;
let r = serve_net::testing::respond(&app, b"OPTIONS /api HTTP/1.1\r\nHost: localhost\r\nOrigin: https://app.example.com\r\nAccess-Control-Request-Method: GET\r\nAccess-Control-Request-Headers: x-csrf-token\r\n\r\n");
assert_eq!(r.header("access-control-max-age"), Some(&b"600"[..]));