-
Notifications
You must be signed in to change notification settings - Fork 1
/
cors.go
121 lines (100 loc) · 2.88 KB
/
cors.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
// reference:
// MDN CORS Specification: https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS
package middleware
import (
"fmt"
"net/http"
"regexp"
"strings"
"github.com/go-zoox/zoox"
)
// CorsConfig is the configuration for the CORS middleware.
type CorsConfig struct {
IgnoreFunc func(ctx *zoox.Context) bool
AllowOrigins []string
AllowOriginFunc func(origin string) bool
AllowMethods []string
AllowHeaders []string
AllowCredentials bool
MaxAge int64
ExposeHeaders []string
}
// DefaultCorsConfig is the default CORS configuration.
func DefaultCorsConfig() *CorsConfig {
return &CorsConfig{
AllowOrigins: []string{"*"},
AllowMethods: []string{"GET", "POST", "PUT", "DELETE", "OPTIONS"},
AllowHeaders: []string{"Origin", "Accept", "Content-Type", "Authorization"},
AllowCredentials: true,
ExposeHeaders: []string{},
}
}
// CORS is a middleware for handling CORS (Cross-Origin Resource Sharing)
func CORS(cfg ...*CorsConfig) zoox.Middleware {
cfgX := DefaultCorsConfig()
if len(cfg) > 0 {
cfgX = cfg[0]
}
return func(ctx *zoox.Context) {
origin := ctx.Origin()
// no origin, no cors
if origin == "" {
ctx.Next()
return
}
if cfgX.IgnoreFunc != nil && cfgX.IgnoreFunc(ctx) {
ctx.Next()
return
}
if cfgX.AllowOriginFunc != nil {
if !cfgX.AllowOriginFunc(origin) {
ctx.Status(http.StatusNoContent)
return // skip
}
} else if len(cfgX.AllowOrigins) > 0 {
var matched bool
var err error
for _, allowOrigin := range cfgX.AllowOrigins {
if allowOrigin == "*" {
matched = true
break
}
if matched, err = regexp.MatchString(allowOrigin, origin); err == nil && matched {
break
}
}
if !matched {
ctx.Status(http.StatusNoContent)
return // skip
}
}
ctx.Set("Access-Control-Allow-Origin", origin)
isPreflight := ctx.Method == http.MethodOptions
// not preflight
if !isPreflight {
// Note that simple GET requests are not preflighted, and so if a request is made for a resource with credentials,
// if this header is not returned with the resource, the response is ignored by the browser and not returned to web content.
if ctx.Method == http.MethodGet && cfgX.AllowCredentials {
ctx.Set("Access-Control-Allow-Credentials", "true")
}
if len(cfgX.ExposeHeaders) > 0 {
ctx.Set("Access-Control-Expose-Headers", strings.Join(cfgX.ExposeHeaders, ","))
}
ctx.Next()
return
}
if len(cfgX.AllowMethods) > 0 {
ctx.Set("Access-Control-Allow-Methods", strings.Join(cfgX.AllowMethods, ","))
}
if len(cfgX.AllowHeaders) > 0 {
ctx.Set("Access-Control-Allow-Headers", strings.Join(cfgX.AllowHeaders, ","))
}
if cfgX.MaxAge != 0 {
ctx.Set("Access-Control-Max-Age", fmt.Sprintf("%d", cfgX.MaxAge))
}
if cfgX.AllowCredentials {
ctx.Set("Access-Control-Allow-Credentials", "true")
}
ctx.String(200, "OK")
}
}