Django CORS

The package dcors is a Django middleware for enabling Cross-Origin Resource Sharing (CORS).

Install the module using:

pip install django-dcors

Code is available at https://github.com/prasanthn/django-dcors .

Values specified in the Django settings module are used to set appropriate headers in HTTP responses. These headers are added to all responses.

Pre-flight requests, i.e., OPTIONS requests that have the Access-Control-Request-Method header, are returned with an empty response containing all the headers mentioned below.

Take this behaviour into account when adding this middleware to the MIDDLEWARE_CLASSES list in the settings module.

Adding headers to all responses is useful since not all requests are "pre-flighted". For example a "simple" credentialed GET request is not "pre-flighted", but the response must have Access-Control-Allow-Credentials set to "true" for the response to be available to the client script.

Setting              Value                  Respone header

CORS_ALLOW_ORIGIN string Access-Control-Allow-Origin CORS_ALLOW_METHODS list Access-Control-Allow-Methods CORS_ALLOW_HEADERS list Access-Control-Allow-Headers CORS_ALLOW_CREDENTIALS "true" or "false" Access-Control-Allow-Credentials CORS_EXPOSE_HEADERS list Access-Control-Expose-Headers CORS_MAX_AGE seconds Access-Control-Max-Age CORS_ALLOW_ALL_ORIGIN <any-value> <see explanation below> CORS_ALLOW_ALL_HEADERS <any-value> <see explanation below>

If the setting CORS_ALLOW_ALL_ORIGIN is present, containing any value, then the Access-Control-Allow-Origin response header is set to the value of the Origin header in the request. This is a shortcut for allowing CORS for all domains.

If the setting CORS_ALLOW_ALL_HEADERS is present, containing any value, then the Access-Control-Allow-Headers response header is set it the value of the Access-Control-Request-Headers header in the request. This is a shortcut for allowing clients to send any header with a CORS request.

By default none of the above values are set, and hence the response will contain empty values for the corresponding header. Note that the headers will be present in the response, but the value of each will be an empty string.

This middleware only adds appropriate headers to responses, and doesn't prevent access based on header values in the request. A web browser will not allow JavaScript to issue requests and access responses that don't conform to the CORS standard. The browser determines the allowed access points using the headers in the response.

See https://developer.mozilla.org/en-US/docs/HTTP/Access_control_CORS for more information on CORS. Web browsers that support CORS can be found at http://caniuse.com/#search=cors .

Tests are present in dcors/tests.py, and have been tested with Django 1.4.5 and 1.5.1 in Python 2.7.3 .