Description
Defines explicit reusable CORS policies for optional middleware.
Create
function Create
(Allowed_Origins : String;
Allowed_Methods : String;
Allowed_Headers : String := "";
Exposed_Headers : String := "";
Allow_Credentials : Boolean := False;
Max_Age : Duration := -1.0) return Policy
Construct a policy. Allowed_Origins is a space-separated exact origin list or "*". Methods and headers are comma-separated token lists. Origin membership is checked token by token, so the wildcard is only accepted as the entire list, and neither the wildcard nor the opaque "null" origin may be combined with credentials.
Parameters
- Allowed_Origins
Exact origins or wildcard
- Allowed_Methods
Allowed request methods
- Allowed_Headers
Allowed request headers
- Exposed_Headers
Response headers exposed to scripts
- Allow_Credentials
Whether credentials are allowed
- Max_Age
Preflight cache duration; negative omits it
Return value
Validated CORS policy
Raised exceptions
- Program_Error
Origins or methods are empty, a value carries control bytes, "" is listed beside other origins, or credentials are granted to "" or to "null"
Credentials
function Credentials (Item : Policy) return Boolean
Report credential permission.
Parameters
- Item
CORS policy
Return value
True when credentials are allowed
Exposed
function Exposed (Item : Policy) return String
Return the configured exposed header list.
Parameters
- Item
CORS policy
Return value
Header-ready exposed header list
Headers
function Headers (Item : Policy) return String
Return the configured allowed header list.
Parameters
- Item
CORS policy
Return value
Header-ready allowed header list
Headers_Allowed
function Headers_Allowed (Item : Policy; Headers : String) return Boolean
Report whether every requested comma-separated header is allowed. Header matching is ASCII case-insensitive.
Parameters
- Item
CORS policy
- Headers
Requested header list
Return value
True when every requested header is allowed
Method_Allowed
function Method_Allowed (Item : Policy; Method : String) return Boolean
Report whether one method is allowed.
Parameters
- Item
CORS policy
- Method
Request method
Return value
True for token membership
Methods
function Methods (Item : Policy) return String
Return the configured allowed method list.
Parameters
- Item
CORS policy
Return value
Header-ready method list
Origin_Allowed
function Origin_Allowed (Item : Policy; Origin : String) return Boolean
Report whether one serialized origin is allowed.
Parameters
- Item
CORS policy
- Origin
Serialized origin
Return value
True for exact membership or wildcard
Policy
type Policy is private;
Immutable-after-setup CORS policy value.
Preflight_Max_Age
function Preflight_Max_Age (Item : Policy) return Duration
Return preflight cache duration.
Parameters
- Item
CORS policy
Return value
Seconds; negative means omitted
Wildcard
function Wildcard (Item : Policy) return Boolean
Report whether wildcard origin is configured.
Parameters
- Item
CORS policy
Return value
True only for "*"