corsAllowOrigin function

dynamic corsAllowOrigin(dynamic origin, String? requestOrigin)

Get the value for the Access-Control-Allow-Origin header.

A browser accepts only one origin or * in this header. So when origin is a list, we look for requestOrigin in the list. We send back only that origin. If it is not in the list, we send nothing. A list that has * allows every origin.

Implementation

dynamic corsAllowOrigin(dynamic origin, String? requestOrigin) {
  if (origin is! List) return origin;
  if (origin.contains('*')) return '*';
  if (requestOrigin != null && origin.contains(requestOrigin)) {
    return requestOrigin;
  }
  return null;
}