setCORS static method

void setCORS(APIRequest request, APIResponse response, { APICORSConfig? cors, })

Sets the CORS headers of response, as configured by cors (defaults to APICORSConfig defaults).

Implementation

static void setCORS(
  APIRequest request,
  APIResponse response, {
  APICORSConfig? cors,
}) {
  cors ??= APICORSConfig();

  var origin = getOrigin(request);

  var allowOrigin = cors.resolveAllowOrigin(origin);
  if (allowOrigin != null) {
    response.headers[HttpHeaders.accessControlAllowOriginHeader] =
        allowOrigin;
  }

  if (cors.varyOrigin) {
    response.headers[HttpHeaders.varyHeader] = _resolveVaryWithOrigin(
      response.headers[HttpHeaders.varyHeader],
    );
  }

  var allowMethods = cors.allowMethods;
  if (allowMethods.isNotEmpty) {
    response.headers[HttpHeaders.accessControlAllowMethodsHeader] =
        allowMethods.join(',');
  }

  response.headers[HttpHeaders.accessControlAllowCredentialsHeader] =
      cors.allowCredentials ? "true" : "false";

  var allowHeaders = cors.resolveAllowHeaders(origin);
  if (allowHeaders.isNotEmpty) {
    response.headers[HttpHeaders.accessControlAllowHeadersHeader] =
        allowHeaders.join(', ');
  }

  var exposeHeaders = cors.exposeHeaders;
  if (exposeHeaders.isNotEmpty) {
    response.headers[HttpHeaders.accessControlExposeHeadersHeader] =
        exposeHeaders.join(', ');
  }

  // Only a preflight response can be cached by `Access-Control-Max-Age`:
  if (cors.maxAge > 0 && request.method == APIRequestMethod.OPTIONS) {
    response.headers[HttpHeaders.accessControlMaxAgeHeader] = cors.maxAge
        .toString();
  }
}