Headers and CORS

The headers middleware sets request/response headers and controls CORS for your application.

CORS

To enable CORS headers, add the following section to your configuration.

version: "3"

http:
  address: 127.0.0.1:44933
  middleware: ["headers"]
  # ...
  headers:
    cors:
      allowed_origin: "https://foo.example.com"
      # If `allowed_origin_regex` option is set, the content of `allowed_origin` is ignored
      allowed_origin_regex: "^https://foo[.]example[.]com$"
      allowed_headers: "*"
      allowed_methods: "GET, POST, PUT, DELETE"
      allow_credentials: true
      exposed_headers: "Cache-Control,Content-Language,Content-Type,Expires,Last-Modified,Pragma"
      max_age: 600
      # Status code to use for successful OPTIONS requests. Default value is 200.
      options_success_status: 200
      # Debugging flag adds additional output to debug server side CORS issues, consider disabling in production.
      debug: false

Make sure to declare "headers" middleware.

Replace the example origin in both settings with your trusted origin. Keep ^ and $ in the regex. Use [.] to match literal dots. Do not use allowed_origin: "*" with allow_credentials: true.

allowed_origin, allowed_methods, allowed_headers, and exposed_headers ignore whitespace around each comma-separated value. For example, "GET, POST" selects both methods.

Custom headers for response or request

You can control additional headers for outgoing responses and headers to be added to requests sent to your application.

Put headers before static in the v6 middleware list to apply headers to static responses. See middleware order.