-
Notifications
You must be signed in to change notification settings - Fork 72
/
cors.go
150 lines (126 loc) · 3.66 KB
/
cors.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
package middleware
import (
"net/http"
"strings"
"github.com/gohade/hade/framework/gin"
)
const (
allowOrigin = "Access-Control-Allow-Origin"
allowMethods = "Access-Control-Allow-Methods"
allowHeaders = "Access-Control-Allow-Headers"
allowCredentials = "Access-Control-Allow-Credentials"
exposeHeaders = "Access-Control-Expose-Headers"
requestMethod = "Access-Control-Request-Method"
requestHeaders = "Access-Control-Request-Headers"
maxAgeHeader = "Access-Control-Max-Age"
varyHeader = "Vary"
originHeader = "Origin"
)
// defaultCORS default cors
var defaultCORS = CORS{
allowCredentials: false,
allowHeaders: []string{"Content-Type", "Origin", "X-CSRF-Token", "Authorization", "AccessToken", "Token", "Range"},
maxAge: "86400",
allowOrigins: []string{"*"},
exposeHeaders: []string{"Content-Length", "Access-Control-Allow-Origin", "Access-Control-Allow-Headers"},
allowMethods: []string{http.MethodGet, http.MethodPost, http.MethodHead, http.MethodPut, http.MethodPatch, http.MethodDelete},
}
// CORS cors
type CORS struct {
allowOrigins []string
allowMethods []string
allowHeaders []string
exposeHeaders []string
allowCredentials bool
maxAge string
}
// CORSOption ...
type CORSOption func(c *CORS)
// WithAllowOrigins set AllowOrigins
func WithAllowOrigins(allowOrigins []string) CORSOption {
return func(c *CORS) {
c.allowOrigins = allowOrigins
}
}
// WithAllowHeaders set AllowHeaders
func WithAllowHeaders(allowHeaders []string) CORSOption {
return func(c *CORS) {
c.allowHeaders = allowHeaders
}
}
// WithAllowMethods set AllowMethods
func WithAllowMethods(allowMethods []string) CORSOption {
return func(c *CORS) {
c.allowMethods = allowMethods
}
}
// WithExposeHeaders set ExposeHeaders
func WithExposeHeaders(exposeHeaders []string) CORSOption {
return func(c *CORS) {
c.exposeHeaders = exposeHeaders
}
}
// WithAllowCredentials set AllowCredentials
func WithAllowCredentials(allowCredentials bool) CORSOption {
return func(c *CORS) {
c.allowCredentials = allowCredentials
}
}
// WithMaxAge set MaxAge
func WithMaxAge(maxAge string) CORSOption {
return func(c *CORS) {
c.maxAge = maxAge
}
}
// NewCORS ...
func NewCORS(opts ...CORSOption) *CORS {
cors := defaultCORS
for _, opt := range opts {
opt(&cors)
}
return &cors
}
// Func ...
func (m *CORS) Func() gin.HandlerFunc {
return func(c *gin.Context) {
c.Writer.Header().Add(varyHeader, originHeader)
if c.Request.Method == http.MethodOptions {
c.Writer.Header().Add(varyHeader, requestMethod)
c.Writer.Header().Add(varyHeader, requestHeaders)
}
origin := c.Request.Header.Get(originHeader)
if b, allowOrigins := isOriginAllowed(m.allowOrigins, origin); b {
m.setCORSHeader(c, allowOrigins)
}
if c.Request.Method == http.MethodOptions {
c.JSON(http.StatusNoContent, nil)
return
}
c.Next()
}
}
// setCORSHeader set cors header
func (m *CORS) setCORSHeader(c *gin.Context, origins []string) {
c.Writer.Header().Set(allowOrigin, strings.Join(origins, ","))
c.Writer.Header().Set(allowMethods, strings.Join(m.allowMethods, ","))
c.Writer.Header().Set(allowHeaders, strings.Join(m.allowHeaders, ","))
c.Writer.Header().Set(exposeHeaders, strings.Join(m.exposeHeaders, ","))
if m.allowCredentials {
c.Writer.Header().Set(allowCredentials, "true")
}
if m.maxAge != "0" {
c.Writer.Header().Set(maxAgeHeader, m.maxAge)
}
}
// isOriginAllowed ...
func isOriginAllowed(allows []string, origin string) (bool, []string) {
for _, o := range allows {
if o == "*" {
return true, []string{"*"}
}
if o == origin {
return true, []string{origin}
}
}
return false, []string{}
}