cors

cors

HTTP middleware for Cross-Origin Resource Sharing (CORS). Validates the Origin header against an allowlist, sets the appropriate response headers, and handles preflight OPTIONS requests.

Usage

import "github.com/OpenNSW/core/cors"

handler = cors.CORS(&cors.Config{
    AllowedOrigins:   []string{"https://portal.example.com", "https://admin.example.com"},
    AllowedMethods:   []string{"GET", "POST", "PUT", "DELETE", "OPTIONS"},
    AllowedHeaders:   []string{"Authorization", "Content-Type"},
    AllowCredentials: true,
    MaxAge:           86400, // preflight cache duration in seconds
})(mux)

Config carries yaml struct tags, so it can be embedded in a larger application config struct and populated generically (e.g. via yaml.Unmarshal):

cors:
  allowedOrigins:
    - https://portal.example.com
    - https://admin.example.com
  allowedMethods:
    - GET
    - POST
    - PUT
    - DELETE
    - OPTIONS
  allowedHeaders:
    - Authorization
    - Content-Type
  allowCredentials: true
  maxAge: 86400

Behaviour

• Origins not in AllowedOrigins receive a 204 No Content response on preflight with no CORS headers set.
• Preflight OPTIONS requests that pass the origin check return 204 with the appropriate Access-Control-* headers.
• Actual requests from allowed origins have CORS headers appended to the response.
• AllowCredentials: true sets Access-Control-Allow-Credentials: true; required when the frontend sends cookies or Authorization headers cross-origin.