CorsMiddleware class

Middleware implementing Cross-Origin Resource Sharing (CORS).

Preflight requests (OPTIONS requests carrying an Access-Control-Request-Method header) are answered by the middleware itself and never reach children. All other requests are forwarded, and the CORS headers are added to their responses if the request origin is allowed.

Inheritance

Constructors

CorsMiddleware({RouteMatcher matcher = const AnyRouteMatcher(), Config<List<String>> allowedOrigins = const Config('cors.allowedOrigins', defaultValue: ['*']), Config<List<String>> allowedMethods = const Config('cors.allowedMethods', defaultValue: ['GET', 'HEAD', 'POST', 'PUT', 'PATCH', 'DELETE']), Config<List<String>> allowedHeaders = const Config('cors.allowedHeaders', defaultValue: ['*']), Config<List<String>> exposedHeaders = const Config('cors.exposedHeaders', defaultValue: []), Config<bool> allowCredentials = const Config('cors.allowCredentials', defaultValue: false), Config<Duration?> maxAge = const Config('cors.maxAge'), required List<ApiNode> routes, bool catchRequests = false})
const

Properties

allowCredentials → Config<bool>
Whether cross-origin requests may include credentials, such as cookies or HTTP authentication.
final
allowedHeaders → Config<List<String>>
Request headers allowed for cross-origin requests.
final
allowedMethods → Config<List<String>>
Methods allowed for cross-origin requests.
final
allowedOrigins → Config<List<String>>
Origins allowed to access routes, e.g. https://example.com.
final
catchRequests → bool
finalinherited
exposedHeaders → Config<List<String>>
Response headers exposed to scripts in addition to the CORS-safelisted response headers.
final
hashCode → int
The hash code for this object.
no setterinherited
matcher → RouteMatcher
finalinherited
maxAge → Config<Duration?>
How long browsers may cache preflight responses.
final
routes → List<ApiNode>
finalinherited
runtimeType → Type
A representation of the runtime type of the object.
no setterinherited

Methods

buildRoutes() → List<ApiRoute>
inherited
isOriginAllowed(String origin, List<String> allowedOrigins) → bool
Whether origin is allowed to access routes.
noSuchMethod(Invocation invocation) → dynamic
Invoked when a nonexistent method or property is accessed.
inherited
onRequest(ApiRequest request, RequestHandler<ApiResponse> next) → Future
override
toString() → String
A string representation of this object.
inherited

Operators

operator ==(Object other) → bool
The equality operator.
inherited