cors

README

CORS Hertz's middleware

Hertz middleware/handler to enable CORS support.

This repo forks from gin cors and adapt it to Hertz.

Usage

Start using it

Download and install it:

go get github.com/hertz-contrib/cors

Import it in your code:

import "github.com/hertz-contrib/cors"

Canonical example

package main

import (
	"context"
	"time"

	"github.com/hertz-contrib/cors"
	"github.com/cloudwego/hertz/pkg/app"
	"github.com/cloudwego/hertz/pkg/app/server"
	"github.com/cloudwego/hertz/pkg/protocol/consts"
)

func main() {
	h := server.Default(server.WithHostPorts("127.0.0.1:8080"))

	h.Use(cors.New(cors.Config{
		AllowOrigins:     []string{"https://foo.com"}, // Allowed domains, need to bring schema
		AllowMethods:     []string{"PUT", "PATCH"},    // Allowed request methods
		AllowHeaders:     []string{"Origin"},          // Allowed request headers
		ExposeHeaders:    []string{"Content-Length"},  // Request headers allowed in the upload_file
		AllowCredentials: true,                        // Whether cookies are attached
		AllowOriginFunc: func(origin string) bool { // Custom domain detection with lower priority than AllowOrigins
			return origin == "https://github.com"
		},
		MaxAge: 12 * time.Hour, // Maximum length of upload_file-side cache preflash requests (seconds)
	}))

	h.GET("/cors", func(ctx context.Context, c *app.RequestContext) {
		c.String(consts.StatusOK, "Hello hertz!")
	})

	h.Spin()
}

Using DefaultConfig as start point

func main() {
  h := server.Default()
  // - No origin allowed by default
  // - GET,POST, PUT, HEAD methods
  // - Credentials share disabled
  // - Preflight requests cached for 12 hours
  config := cors.DefaultConfig()
  config.AllowOrigins = []string{"http://google.com"}
  // config.AllowOrigins = []string{"http://google.com", "http://facebook.com"}
  // config.AllowAllOrigins = true

  h.Use(cors.New(config))
  h.Spin()
}

note: while Default() allows all origins, DefaultConfig() does not and you will still have to use AllowAllOrigins

Default() allows all origins

func main() {
  h := server.Default()
  // same as
  // config := cors.DefaultConfig()
  // config.AllowAllOrigins = true
  // h.Use(cors.New(config))
  h.Use(cors.Default())
  h.Spin()
}

Documentation

Index

• Variables
• func Default() app.HandlerFunc
• func New(config Config) app.HandlerFunc
• type Config
  • func DefaultConfig() Config
  • func (c *Config) AddAllowHeaders(headers ...string)
  • func (c *Config) AddAllowMethods(methods ...string)
  • func (c *Config) AddExposeHeaders(headers ...string)
  • func (c Config) Validate() error

Variables

var (
	DefaultHeaderBytes = [][]byte{
		[]byte("OPTIONS"),
		[]byte("GET"),
		[]byte("POST"),
	}
	DefaultSchemas = []string{
		"http://",
		"https://",
	}
	DefaultSchemasBytes = [][]byte{
		[]byte("http://"),
		[]byte("https://"),
	}
	ExtensionSchemas = []string{
		"chrome-extension://",
		"safari-extension://",
		"moz-extension://",
		"ms-browser-extension://",
	}
	FileSchemas = []string{
		"file://",
	}
	WebSocketSchemas = []string{
		"ws://",
		"wss://",
	}
)

Functions

func Default

func Default() app.HandlerFunc

Default returns the location middleware with default configuration.

func New

func New(config Config) app.HandlerFunc

New returns the location middleware with user-defined custom configuration.

Types

type Config

type Config struct {
	AllowAllOrigins bool

	// AllowOrigins is a list of origins a cross-domain request can be executed from.
	// If the special "*" value is present in the list, all origins will be allowed.
	// Default value is []
	AllowOrigins []string

	// AllowOriginFunc is a custom function to validate the origin. It takes the origin
	// as argument and returns true if allowed or false otherwise.
	// AllowOrigins have a higher AllowOrigins have a higher priority than AllowOriginFunc
	// It is recommended to use AllowOriginFunc without setting AllowOrigins.
	AllowOriginFunc func(origin string) bool

	// AllowMethods is a list of methods the client is allowed to use with
	// cross-domain requests. Default value is simple methods (GET and POST)
	AllowMethods []string

	// AllowHeaders is list of non simple headers the client is allowed to use with
	// cross-domain requests.
	AllowHeaders []string

	// AllowCredentials indicates whether the request can include user credentials like
	// cookies, HTTP authentication or client side SSL certificates.
	AllowCredentials bool

	// ExposedHeaders indicates which headers are safe to expose to the API of a CORS
	// API specification
	ExposeHeaders []string

	// MaxAge indicates how long (in seconds) the results of a preflight request
	// can be cached
	MaxAge time.Duration

	// Allows to add origins like http://some-domain/*, https://api.* or http://some.*.subdomain.com
	AllowWildcard bool

	// Allows usage of popular browser extensions schemas
	AllowBrowserExtensions bool

	// Allows usage of WebSocket protocol
	AllowWebSockets bool

	// Allows usage of file:// schema (dangerous!) use it only when you 100% sure it's needed
	AllowFiles bool
}

Config represents all available options for the middleware.

func DefaultConfig

func DefaultConfig() Config

DefaultConfig returns a generic default configuration mapped to localhost.

func (*Config) AddAllowHeaders

func (c *Config) AddAllowHeaders(headers ...string)

AddAllowHeaders is allowed to add custom headers

func (*Config) AddAllowMethods

func (c *Config) AddAllowMethods(methods ...string)

AddAllowMethods is allowed to add custom methods

func (*Config) AddExposeHeaders

func (c *Config) AddExposeHeaders(headers ...string)

AddExposeHeaders is allowed to add custom expose headers

func (Config) Validate

func (c Config) Validate() error

Validate is check configuration of user defined.