cors

func DefaultMiddleware ¶

func DefaultMiddleware() httpcontract.Middleware

func Middleware ¶

func Middleware(service *Service) httpcontract.Middleware

Middleware decorates the handler path: it answers a preflight and applies the response headers for responses produced inside the middleware chain. A response produced by an event listener — a security refusal, an error page — never enters the chain, so this door never sees it, and a preflight to a path access control protects is refused before the chain is built. An application that needs those covered registers the listener doors through RegisterListeners.

func RegisterListeners ¶ added in v2.13.0

func RegisterListeners(eventDispatcher eventcontract.EventDispatcher, service *Service)

RegisterListeners wires both cors doors at once: the request listener that answers a preflight before the security chain can refuse it, and the response listener that decorates every response — the security refusals and the error pages the middleware chain never sees included. An application serving cross-origin traffic registers these; the Middleware remains for decorating the handler path inside the chain.

func RegisterRequestListener ¶ added in v2.13.0

func RegisterRequestListener(eventDispatcher eventcontract.EventDispatcher, service *Service)

RegisterRequestListener answers a well-formed preflight from an allowed origin before the security chain runs. A disallowed or absent origin and an OPTIONS request that is not a preflight fall through untouched, so the listener can only answer what the cors middleware would have answered had the request reached it, never widen what security refuses. A preflight from an allowed origin that a listener ahead of this one already answered is the one case that is neither answered nor left alone: its STATUS is untouched, and it is decorated with the cross-origin headers for the reason spelled out at that branch.

func RegisterResponseListener ¶

func RegisterResponseListener(eventDispatcher eventcontract.EventDispatcher, service *Service)

func Restrictive ¶

func Restrictive(allowedOrigins ...string) httpcontract.Middleware