Struct CorsLayer 

pub struct CorsLayer { /* private fields */ }

Available on crate feature http only.

Layer that applies the Cors middleware which adds headers for CORS.

See the module docs for an example.

Implementations

impl CorsLayer

pub fn new() -> CorsLayer

Create a new CorsLayer.

No headers are sent by default. Use the builder methods to customize the behavior.

You need to set at least an allowed origin for browsers to make successful cross-origin requests to your service.

pub fn permissive() -> CorsLayer

A permissive configuration:

• All request headers allowed.
• All methods allowed.
• All origins allowed.
• All headers exposed.

pub fn very_permissive() -> CorsLayer

A very permissive configuration:

• Credentials allowed.
• The method received in Access-Control-Request-Method is sent back as an allowed method.
• The origin of the preflight request is sent back as an allowed origin.
• The header names received in Access-Control-Request-Headers are sent back as allowed headers.
• No headers are currently exposed, but this may change in the future.

pub fn try_with_allow_credentials(self) -> Result<CorsLayer, OpaqueError>

Always set the Access-Control-Allow-Credentials header.

Errors

Errors in case any of the other CORS headers which support the wildcard value have been set to use it.

pub fn try_set_allow_credentials( &mut self, ) -> Result<&mut CorsLayer, OpaqueError>

Always set the Access-Control-Allow-Credentials header.

Errors

Errors in case any of the other CORS headers which support the wildcard value have been set to use it.

pub fn with_allow_credentials_if( self, predicate: impl Fn(&HeaderValue, &Parts) -> bool + Send + Sync + 'static, ) -> CorsLayer

Set the Access-Control-Allow-Credentials header if predicate is satisfied.

pub fn set_allow_credentials_if( &mut self, predicate: impl Fn(&HeaderValue, &Parts) -> bool + Send + Sync + 'static, ) -> &mut CorsLayer

Set the Access-Control-Allow-Credentials header if predicate is satisfied.

pub fn try_with_allow_headers( self, headers: AccessControlAllowHeaders, ) -> Result<CorsLayer, OpaqueError>

Set the value of the Access-Control-Allow-Headers header.

Errors

Errors in case credentials are allowed and the given header contains the wildcard value (*).

pub fn try_set_allow_headers( &mut self, headers: AccessControlAllowHeaders, ) -> Result<&mut CorsLayer, OpaqueError>

Set the value of the Access-Control-Allow-Headers header.

Errors

Errors in case credentials are allowed and the given header contains the wildcard value (*).

pub fn with_max_age(self, header: AccessControlMaxAge) -> CorsLayer

Set the value of the Access-Control-Max-Age header.

By default the header will not be set which disables caching and will require a preflight call for all requests.

Note that each browser has a maximum internal value that takes precedence when the Access-Control-Max-Age is greater. For more details see mdn.

If you need more flexibility, you can use supply a function which can dynamically decide the optional max-age based on the origin and other parts of each preflight request.

pub fn set_max_age(&mut self, header: AccessControlMaxAge) -> &mut CorsLayer

Set the value of the Access-Control-Max-Age header.

By default the header will not be set which disables caching and will require a preflight call for all requests.

Note that each browser has a maximum internal value that takes precedence when the Access-Control-Max-Age is greater. For more details see mdn.

If you need more flexibility, you can use supply a function which can dynamically decide the optional max-age based on the origin and other parts of each preflight request.

pub fn with_max_age_if( self, predicate: impl Fn(&HeaderValue, &Parts) -> Option<Seconds> + Send + Sync + 'static, ) -> CorsLayer

Set the Access-Control-Max-Age header if predicate is satisfied.

See Self::with_max_age and Self::set_max_age for more information.

pub fn set_max_age_if( &mut self, predicate: impl Fn(&HeaderValue, &Parts) -> Option<Seconds> + Send + Sync + 'static, ) -> &mut CorsLayer

Set the Access-Control-Max-Age header if predicate is satisfied.

See Self::with_max_age and Self::set_max_age for more information.

pub fn try_with_allow_methods( self, methods: AccessControlAllowMethods, ) -> Result<CorsLayer, OpaqueError>

Set the value of the Access-Control-Allow-Methods header.

Errors

Errors in case credentials are allowed and the given header contains the wildcard value (*).

pub fn try_set_allow_methods( &mut self, methods: AccessControlAllowMethods, ) -> Result<&mut CorsLayer, OpaqueError>

Set the value of the Access-Control-Allow-Methods header.

Errors

Errors in case credentials are allowed and the given header contains the wildcard value (*).

pub fn try_with_allow_origin_any(self) -> Result<CorsLayer, OpaqueError>

Only set the Access-Control-Allow-Origin header with the wildcard value (*).

Errors

Errors in case credentials are allowed.

pub fn try_set_allow_origin_any( &mut self, ) -> Result<&mut CorsLayer, OpaqueError>

Only set the Access-Control-Allow-Origin header with the wildcard value (*).

Errors

Errors in case credentials are allowed.

pub fn with_allow_origin_if_null(self) -> CorsLayer

Only set the Access-Control-Allow-Origin header with the “null” value when that is the origin.

Note: The value null should not be used. It may seem safe to return Access-Control-Allow-Origin: "null"; however, the origin of resources that use a non-hierarchical scheme (such as data: or file:) and sandboxed documents is serialized as null. Many browsers will grant such documents access to a response with an Access-Control-Allow-Origin: null header, and any origin can create a hostile document with a null origin. Therefore, the null value for the Access-Control-Allow-Origin header should be avoided

pub fn set_allow_origin_if_null(&mut self) -> &mut CorsLayer

Only set the Access-Control-Allow-Origin header with the “null” value when that is the origin.

Note: The value null should not be used. It may seem safe to return Access-Control-Allow-Origin: "null"; however, the origin of resources that use a non-hierarchical scheme (such as data: or file:) and sandboxed documents is serialized as null. Many browsers will grant such documents access to a response with an Access-Control-Allow-Origin: null header, and any origin can create a hostile document with a null origin. Therefore, the null value for the Access-Control-Allow-Origin header should be avoided

pub fn with_allow_origin_if( self, predicate: impl Fn(&HeaderValue, &Parts) -> bool + Send + Sync + 'static, ) -> CorsLayer

Set the value of the Access-Control-Allow-Origin header if the predicate satisfied.

pub fn set_allow_origin_if( &mut self, predicate: impl Fn(&HeaderValue, &Parts) -> bool + Send + Sync + 'static, ) -> &mut CorsLayer

Set the value of the Access-Control-Allow-Origin header if the predicate satisfied.

pub fn try_with_expose_headers( self, headers: AccessControlExposeHeaders, ) -> Result<CorsLayer, OpaqueError>

Set the value of the Access-Control-Expose-Headers header.

Errors

Errors in case credentials are allowed and the given header contains the wildcard value (*).

pub fn try_set_expose_headers( &mut self, headers: AccessControlExposeHeaders, ) -> Result<&mut CorsLayer, OpaqueError>

Set the value of the Access-Control-Expose-Headers header.

Errors

Errors in case credentials are allowed and the given header contains the wildcard value (*).

pub fn with_allow_private_network(self) -> CorsLayer

Always set the Access-Control-Allow-Private-Network header.

pub fn set_allow_private_network(&mut self) -> &mut CorsLayer

Always set the Access-Control-Allow-Private-Network header.

pub fn with_allow_private_network_if( self, predicate: impl Fn(&HeaderValue, &Parts) -> bool + Send + Sync + 'static, ) -> CorsLayer

Set the Access-Control-Allow-Private-Network header if predicate is satisfied.

pub fn set_allow_private_network_if( &mut self, predicate: impl Fn(&HeaderValue, &Parts) -> bool + Send + Sync + 'static, ) -> &mut CorsLayer

Set the Access-Control-Allow-Private-Network header if predicate is satisfied.

pub fn with_vary(self, header: Vary) -> CorsLayer

Set the value(s) of the Vary header.

You only need to set this is you want to remove some of these defaults, or if you use a closure for one of the other headers and want to add a vary header accordingly.

pub fn set_vary(&mut self, header: Vary) -> &mut CorsLayer

Set the value(s) of the Vary header.

You only need to set this is you want to remove some of these defaults, or if you use a closure for one of the other headers and want to add a vary header accordingly.

pub fn handle_options_request(self) -> CorsLayer

Handle OPTIONS request with the inner service.

By default it is not passed on to the inner service, and instead just returned with a 200 OK (empty body).

NOTE that this does not stop the response headers from being added, it only defines who “creates” the response, the modification happens regardless.

Trait Implementations

impl Clone for CorsLayer

fn clone(&self) -> CorsLayer

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for CorsLayer

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl Default for CorsLayer

fn default() -> CorsLayer

Returns the “default value” for a type.

impl<S> Layer<S> for CorsLayer

type Service = Cors<S>

The service produced by the layer.

fn layer(&self, inner: S) -> <CorsLayer as Layer<S>>::Service

Wrap the given service with the middleware, returning a new service.

fn into_layer(self, inner: S) -> <CorsLayer as Layer<S>>::Service

Same as layer but consuming self after the service was created.