messua/mware/cors

CORS configuration

The functions in this module are for configuring and building a CORS middleware layer.

import messua/handle
import messua/mware/cors

let cors_layer = cors.new()
|> cors.allow_method(handle.method_get)
|> cors.allow_method(handle.method_post)
|> cors.allow_origin("www.foo.bar")
|> cors.allow_origin("foo.bar")
|> cors.allow_origin("w3.foo.bar")
|> cors.allow_all_headers()
|> cors.expose_header("x-foo-setting")
|> cors.expose_header("x-bar-factor")
|> cors.allow_credentials()
|> cors.max_age(7200)
|> cors.make_layer()

Types

CORS configuration, which can be passed to make_layer() to make a CORS-handling layer.

pub opaque type Config

Values

pub fn all_origins(cfg: Config) -> Config

Allow all origins.

Will cause responses to OPTIONS requests to include the header access-control-allow-origin: *

pub fn allow_all_headers(cfg: Config) -> Config

Allow the browser to send any headers it wants with a request.

pub fn allow_credentials(cfg: Config) -> Config

Allow the browser to send credentials with a request.

pub fn allow_header(cfg: Config, header: String) -> Config

Allow the browser to use the given header in a request. Use this function several times to allow multiple headers.

pub fn allow_method(cfg: Config, method: Method) -> Config

Allow the given HTTP method. Use this function several times to allow multiple methods.

pub fn allow_origin(cfg: Config, origin: String) -> Config

Allow a specific origin. Use this function several times to allow multiple origins.

pub fn expose_all_headers(cfg: Config) -> Config

Expose all headers to the browser’s JS engine.

pub fn expose_header(cfg: Config, header: String) -> Config

Expose the given response header to the browser engine that makes the request. Use this function several times to expose multiple headers.

pub fn make_layer(
  cfg: Config,
) -> fn(
  MRequest(a),
  fn(MRequest(a)) -> Result(Response(ResponseData), Err),
) -> Result(Response(ResponseData), Err)

Generate a Layer function from the given Config for using in a middleware stack.

pub fn max_age(cfg: Config, seconds: Int) -> Config

Set the maximum age of the CORS response (in seconds), so the browser doesn’t (necessarily) have to make a preflight for every subsequent similar request.

pub fn new() -> Config

Create a new, maximally-restrictive CORS configuration:

  • no allowed origins
  • no allowed headers
  • no exposed headers
  • no allowed methods
  • credentials not allowed
  • no statement about caching

These restrictions can be relaxed with the builder-pattern functions in this module.

Search Document