Struct CorsLayer

pub struct CorsLayer { /* private fields */ }

Expand description

Layer that applies the [Cors] middleware which adds headers for CORS.

See the module docs for an example.

Implementations§

§

impl CorsLayer

pub fn new() -> CorsLayer

Create a new CorsLayer.

No headers are sent by default. Use the builder methods to customize the behavior.

You need to set at least an allowed origin for browsers to make successful cross-origin requests to your service.

pub fn permissive() -> CorsLayer

A permissive configuration:

All request headers allowed.
All methods allowed.
All origins allowed.
All headers exposed.

pub fn very_permissive() -> CorsLayer

A very permissive configuration:

Credentials allowed.
The method received in Access-Control-Request-Method is sent back as an allowed method.
The origin of the preflight request is sent back as an allowed origin.
The header names received in Access-Control-Request-Headers are sent back as allowed headers.
No headers are currently exposed, but this may change in the future.

pub fn allow_credentials<T>(self, allow_credentials: T) -> CorsLayer
where T: Into<AllowCredentials>,

Set the Access-Control-Allow-Credentials header.

use tower_http::cors::CorsLayer;

let layer = CorsLayer::new().allow_credentials(true);

pub fn allow_headers<T>(self, headers: T) -> CorsLayer
where T: Into<AllowHeaders>,

Set the value of the Access-Control-Allow-Headers header.

use tower_http::cors::CorsLayer;
use http::header::{AUTHORIZATION, ACCEPT};

let layer = CorsLayer::new().allow_headers([AUTHORIZATION, ACCEPT]);

All headers can be allowed with

use tower_http::cors::{Any, CorsLayer};

let layer = CorsLayer::new().allow_headers(Any);

Note that multiple calls to this method will override any previous calls.

Also note that Access-Control-Allow-Headers is required for requests that have Access-Control-Request-Headers.

pub fn max_age<T>(self, max_age: T) -> CorsLayer
where T: Into<MaxAge>,

Set the value of the Access-Control-Max-Age header.

use std::time::Duration;
use tower_http::cors::CorsLayer;

let layer = CorsLayer::new().max_age(Duration::from_secs(60) * 10);

By default the header will not be set which disables caching and will require a preflight call for all requests.

Note that each browser has a maximum internal value that takes precedence when the Access-Control-Max-Age is greater. For more details see mdn.

If you need more flexibility, you can use supply a function which can dynamically decide the max-age based on the origin and other parts of each preflight request:

use std::time::Duration;

use http::{request::Parts as RequestParts, HeaderValue};
use tower_http::cors::{CorsLayer, MaxAge};

let layer = CorsLayer::new().max_age(MaxAge::dynamic(
    |_origin: &HeaderValue, parts: &RequestParts| -> Duration {
        // Let's say you want to be able to reload your config at
        // runtime and have another middleware that always inserts
        // the current config into the request extensions
        let config = parts.extensions.get::<MyServerConfig>().unwrap();
        config.cors_max_age
    },
));

pub fn allow_methods<T>(self, methods: T) -> CorsLayer
where T: Into<AllowMethods>,

Set the value of the Access-Control-Allow-Methods header.

use tower_http::cors::CorsLayer;
use http::Method;

let layer = CorsLayer::new().allow_methods([Method::GET, Method::POST]);

All methods can be allowed with

use tower_http::cors::{Any, CorsLayer};

let layer = CorsLayer::new().allow_methods(Any);

Note that multiple calls to this method will override any previous calls.

pub fn allow_origin<T>(self, origin: T) -> CorsLayer
where T: Into<AllowOrigin>,

Set the value of the Access-Control-Allow-Origin header.

use http::HeaderValue;
use tower_http::cors::CorsLayer;

let layer = CorsLayer::new().allow_origin(
    "http://example.com".parse::<HeaderValue>().unwrap(),
);

Multiple origins can be allowed with

use tower_http::cors::CorsLayer;

let origins = [
    "http://example.com".parse().unwrap(),
    "http://api.example.com".parse().unwrap(),
];

let layer = CorsLayer::new().allow_origin(origins);

All origins can be allowed with

use tower_http::cors::{Any, CorsLayer};

let layer = CorsLayer::new().allow_origin(Any);

You can also use a closure

use tower_http::cors::{CorsLayer, AllowOrigin};
use http::{request::Parts as RequestParts, HeaderValue};

let layer = CorsLayer::new().allow_origin(AllowOrigin::predicate(
    |origin: &HeaderValue, _request_parts: &RequestParts| {
        origin.as_bytes().ends_with(b".rust-lang.org")
    },
));

You can also use an async closure:

use tower_http::cors::{CorsLayer, AllowOrigin};
use http::{request::Parts as RequestParts, HeaderValue};

let client = get_api_client();

let layer = CorsLayer::new().allow_origin(AllowOrigin::async_predicate(
    |origin: HeaderValue, _request_parts: &RequestParts| async move {
        // fetch list of origins that are allowed
        let origins = client.fetch_allowed_origins().await;
        origins.contains(&origin)
    },
));

let client = get_api_client();

// if using &RequestParts, make sure all the values are owned
// before passing into the future
let layer = CorsLayer::new().allow_origin(AllowOrigin::async_predicate(
    |origin: HeaderValue, parts: &RequestParts| {
        let path = parts.uri.path().to_owned();

        async move {
            // fetch list of origins that are allowed for this path
            let origins = client.fetch_allowed_origins_for_path(path).await;
            origins.contains(&origin)
        }
    },
));

Note that multiple calls to this method will override any previous calls.

pub fn expose_headers<T>(self, headers: T) -> CorsLayer
where T: Into<ExposeHeaders>,

Set the value of the Access-Control-Expose-Headers header.

use tower_http::cors::CorsLayer;
use http::header::CONTENT_ENCODING;

let layer = CorsLayer::new().expose_headers([CONTENT_ENCODING]);

All headers can be allowed with

use tower_http::cors::{Any, CorsLayer};

let layer = CorsLayer::new().expose_headers(Any);

Note that multiple calls to this method will override any previous calls.

pub fn allow_private_network<T>(self, allow_private_network: T) -> CorsLayer
where T: Into<AllowPrivateNetwork>,

Set the value of the Access-Control-Allow-Private-Network header.

use tower_http::cors::CorsLayer;

let layer = CorsLayer::new().allow_private_network(true);

pub fn vary<T>(self, headers: T) -> CorsLayer
where T: Into<Vary>,

Set the value(s) of the Vary header.

By default, this value is derived from whether CORS response headers are request-dependent:

Origin is included when Access-Control-Allow-Origin depends on the request’s Origin header (for example, origin lists or predicates).
Access-Control-Request-Method is included when Access-Control-Allow-Methods mirrors Access-Control-Request-Method.
Access-Control-Request-Headers is included when Access-Control-Allow-Headers mirrors Access-Control-Request-Headers.
If none of those values are request-dependent, no Vary header is added.