CORS

CORS middleware implements CORS specification. CORS gives web servers cross-domain access controls, which enable secure cross-domain data transfers.

Usage

  1. e.Use(middleware.CORS())

Custom Configuration

Usage

  1. e := echo.New()
  2. e.Use(middleware.CORSWithConfig(middleware.CORSConfig{
  3.   AllowOrigins: []string{"https://labstack.com", "https://labstack.net"},
  4.   AllowHeaders: []string{echo.HeaderOrigin, echo.HeaderContentType, echo.HeaderAccept},
  5. }))

Configuration

  1. CORSConfig struct {
  2.   // Skipper defines a function to skip middleware.
  3.   Skipper Skipper
  5.   // AllowOrigin defines a list of origins that may access the resource.
  6.   // Optional. Default value []string{"*"}.
  7.   AllowOrigins []string `yaml:"allow_origins"`
  9.   // AllowOriginFunc is a custom function to validate the origin. It takes the
  10.   // origin as an argument and returns true if allowed or false otherwise. If
  11.   // an error is returned, it is returned by the handler. If this option is
  12.   // set, AllowOrigins is ignored.
  13.   // Optional.
  14.   AllowOriginFunc func(origin string) (bool, error) `yaml:"allow_origin_func"`
  16.   // AllowMethods defines a list methods allowed when accessing the resource.
  17.   // This is used in response to a preflight request.
  18.   // Optional. Default value DefaultCORSConfig.AllowMethods.
  19.   AllowMethods []string `yaml:"allow_methods"`
  21.   // AllowHeaders defines a list of request headers that can be used when
  22.   // making the actual request. This is in response to a preflight request.
  23.   // Optional. Default value []string{}.
  24.   AllowHeaders []string `yaml:"allow_headers"`
  26.   // AllowCredentials indicates whether or not the response to the request
  27.   // can be exposed when the credentials flag is true. When used as part of
  28.   // a response to a preflight request, this indicates whether or not the
  29.   // actual request can be made using credentials.
  30.   // Optional. Default value false.
  31.   AllowCredentials bool `yaml:"allow_credentials"`
  33.   // ExposeHeaders defines a whitelist headers that clients are allowed to
  34.   // access.
  35.   // Optional. Default value []string{}.
  36.   ExposeHeaders []string `yaml:"expose_headers"`
  38.   // MaxAge indicates how long (in seconds) the results of a preflight request
  39.   // can be cached.
  40.   // Optional. Default value 0.
  41.   MaxAge int `yaml:"max_age"`
  42. }

Default Configuration

  1. DefaultCORSConfig = CORSConfig{
  2.   Skipper:      DefaultSkipper,
  3.   AllowOrigins: []string{"*"},
  4.   AllowMethods: []string{http.MethodGet, http.MethodHead, http.MethodPut, http.MethodPatch, http.MethodPost, http.MethodDelete},
  5. }