CORS (Cross-Origin Resource Sharing) plug for Tango OAuth API.

This plug handles CORS headers to allow web applications to make cross-origin requests to the OAuth API endpoints.

Configuration

Configure CORS settings in your application config:

config :tango, :api,
  cors_origins: ["http://localhost:3000", "https://myapp.com"],
  cors_methods: ["GET", "POST", "DELETE", "OPTIONS"],
  cors_headers: ["authorization", "content-type", "x-tenant-id"],
  cors_max_age: 86400,
  cors_credentials: false

Default Behavior

• Environment-based default origins (secure by default in production)
• Credentials disabled by default (API key auth doesn't need cookies)
• Supports preflight OPTIONS requests
• Configurable origins, methods, and headers
• Default max age of 24 hours for preflight cache

Security Notes

• Production defaults to empty origins list - must be explicitly configured
• Development/test environments include wildcard "*" for convenience
• Credentials are disabled by default as API key auth doesn't require cookies