Cors constructor

Cors({
  1. AllowedOrigins origins = const AllowedOrigins.any(),
  2. Set<String> methods = const {'GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'OPTIONS'},
  3. Set<String> headers = const {'accept', 'authorization', 'content-type'},
  4. Set<String> exposeHeaders = const {},
  5. bool credentials = false,
  6. Duration? maxAge,
})

Allows origins, with the usual defaults for everything else.

Implementation

Cors({
  this.origins = const AllowedOrigins.any(),
  this.methods = const {'GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'OPTIONS'},
  this.headers = const {'accept', 'authorization', 'content-type'},
  this.exposeHeaders = const {},
  this.credentials = false,
  this.maxAge,
}) {
  if (credentials && origins.headerFor('https://example.test') == '*') {
    throw ArgumentError(
      'CORS credentials cannot be used with AllowedOrigins.any(): a browser '
      'refuses a credentialed response whose allowed origin is "*". Name the '
      'origins with AllowedOrigins.only or .matching instead.',
    );
  }
}