39 lines
1.1 KiB
Go
39 lines
1.1 KiB
Go
package middleware
|
|
|
|
import "net/http"
|
|
|
|
// CORS adds CORS headers and short-circuits preflight requests.
|
|
func CORS(allowedOrigins []string) func(http.Handler) http.Handler {
|
|
originSet := make(map[string]struct{}, len(allowedOrigins))
|
|
for _, o := range allowedOrigins {
|
|
originSet[o] = struct{}{}
|
|
}
|
|
|
|
return func(next http.Handler) http.Handler {
|
|
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
origin := r.Header.Get("Origin")
|
|
|
|
// Empty allowedOrigins means allow all.
|
|
allowed := len(originSet) == 0
|
|
if !allowed {
|
|
_, allowed = originSet[origin]
|
|
}
|
|
|
|
if allowed && origin != "" {
|
|
w.Header().Set("Access-Control-Allow-Origin", origin)
|
|
w.Header().Set("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE, PATCH, OPTIONS")
|
|
w.Header().Set("Access-Control-Allow-Headers", "Content-Type, Authorization")
|
|
w.Header().Set("Access-Control-Allow-Credentials", "true")
|
|
w.Header().Set("Access-Control-Max-Age", "86400")
|
|
}
|
|
|
|
if r.Method == http.MethodOptions {
|
|
w.WriteHeader(http.StatusNoContent)
|
|
return
|
|
}
|
|
|
|
next.ServeHTTP(w, r)
|
|
})
|
|
}
|
|
}
|