Description
Defines explicit reusable CORS policies for optional middleware.
Create
function Create
(Allowed_Origins : String;
Allowed_Methods : String;
Allowed_Headers : String := "";
Exposed_Headers : String := "";
Allow_Credentials : Boolean := False;
Max_Age : Duration := -1.0) return Policy
Construct a policy. Allowed_Origins is a space-separated exact origin list or "*". Methods and headers are comma-separated token lists. Wildcard origin with credentials is rejected.
Parameters
- Allowed_Origins
Exact origins or wildcard
- Allowed_Methods
Allowed request methods
- Allowed_Headers
Allowed request headers
- Exposed_Headers
Response headers exposed to scripts
- Allow_Credentials
Whether credentials are allowed
- Max_Age
Preflight cache duration; negative omits it
Return value
Validated CORS policy
Credentials
function Credentials (Item : Policy) return Boolean
Report credential permission.
Parameters
- Item
CORS policy
Return value
True when credentials are allowed
Exposed
function Exposed (Item : Policy) return String
Return the configured exposed header list.
Parameters
- Item
CORS policy
Return value
Header-ready exposed header list
Headers
function Headers (Item : Policy) return String
Return the configured allowed header list.
Parameters
- Item
CORS policy
Return value
Header-ready allowed header list
Headers_Allowed
function Headers_Allowed (Item : Policy; Headers : String) return Boolean
Report whether every requested comma-separated header is allowed. Header matching is ASCII case-insensitive.
Parameters
- Item
CORS policy
- Headers
Requested header list
Return value
True when every requested header is allowed
Method_Allowed
function Method_Allowed (Item : Policy; Method : String) return Boolean
Report whether one method is allowed.
Parameters
- Item
CORS policy
- Method
Request method
Return value
True for token membership
Methods
function Methods (Item : Policy) return String
Return the configured allowed method list.
Parameters
- Item
CORS policy
Return value
Header-ready method list
Origin_Allowed
function Origin_Allowed (Item : Policy; Origin : String) return Boolean
Report whether one serialized origin is allowed.
Parameters
- Item
CORS policy
- Origin
Serialized origin
Return value
True for exact membership or wildcard
Policy
type Policy is private;
Immutable-after-setup CORS policy value.
Preflight_Max_Age
function Preflight_Max_Age (Item : Policy) return Duration
Return preflight cache duration.
Parameters
- Item
CORS policy
Return value
Seconds; negative means omitted
Wildcard
function Wildcard (Item : Policy) return Boolean
Report whether wildcard origin is configured.
Parameters
- Item
CORS policy
Return value
True only for "*"