CORS
Lets pages on other origins call the API.
import { } from "@vxnsin/inkan";
.(({ : ["https://shop.example"], : true }));Answers preflight requests and puts the access-control-* headers on every answer, so a
page on another origin may call the API from the browser. It is a shared plugin:
app.register(cors(…)) covers every route of the app, scope.register(cors(…)) inside a
plugin only the routes of that scope. Preflights to a path without an OPTIONS route of its
own are answered too.
Options
| option | default | |
|---|---|---|
origins | "*" | which origins may call: "*", a list, or a function (origin, ctx) => boolean |
credentials | false | lets the browser send cookies and auth headers; the origin is then echoed instead of *, with vary: origin |
maxAge | seconds the browser may reuse a preflight answer | |
methods | every method inkan routes | the methods a preflight allows |
allowHeaders | whatever the browser asks for | the request headers a preflight allows |
exposeHeaders | response headers the page may read besides the simple ones |
origins is the same Origins type WebSockets
take. A function gets the request's Origin header and a PreContext (method, path,
headers, protocol, ip): the request as it arrived, before any hook. A request without
an Origin is no cross-origin call and gets no CORS headers, so the function is only asked
about one with an Origin.
Examples
.(({ : ["https://shop.example", "https://admin.shop.example"] }));
.(({ : () => ?.(".shop.example") ?? false, : 600 }));
.(({ : ["x-request-id"] }));