CORS

Vapor by default provides a middleware for implementing proper support for Cross-Origin Resource Sharing (CORS) named CORSMiddleware.

"Cross-Origin Resource Sharing (CORS) is a specification that enables truly open access across domain-boundaries. If you serve public content, please consider using CORS to open it up for universal JavaScript / browser access." - http://enable-cors.org/

To learn more about middlewares, please visit the Middleware section of the documentation here.

Image Author: Wikipedia

Basic

First of all, add the CORS middleware into your droplet middlewares array.

Config/droplet.json

{
    ...,
    "middleware": [
        ...,
        "cors",
        ...,
    ],
    ...,
}

Next time you boot your application, you will be prompted to add a Config/cors.json file.

Config/cors.json

{
    "allowedOrigin": "*",
    "allowedMethods": ["GET", "POST", "PUT", "OPTIONS", "DELETE", "PATCH"],
    "allowedHeaders": [
       "Accept",
       "Authorization",
       "Content-Type",
       "Origin",
       "X-Requested-With"
    ]
}

Note: Make sure you insert CORS middleware before any other throwing middlewares, like the AbortMiddleware or similar. Otherwise the proper headers might not be added to the response.

CORSMiddleware has a default configuration which should suit most users, with values as follows:

• Allowed Origin
  • Value of origin header in the request.
• Allowed Methods
  • GET, POST, PUT, OPTIONS, DELETE, PATCH
• Allowed Headers
  • Accept, Authorization, Content-Type, Origin, X-Requested-With

Advanced

All settings and presets can be customized by advanced users. There's two ways of doing this, either you programatically create and configure a CORSConfiguration object or you can put your configuration into a Vapor's JSON config file.

See below for how to set up both and what are the options.

Configuration

The CORSConfiguration struct is used to configure the CORSMiddleware. You can instanitate one like this:

let config = try Config()
config.addConfigurable(middleware: { config in
    return CORSConfiguration(
        allowedOrigin: .custom("https://vapor.codes"),
        allowedMethods: [.get, .post, .options],
        allowedHeaders: ["Accept", "Authorization"],
        allowCredentials: false,
        cacheExpiration: 600,
        exposedHeaders: ["Cache-Control", "Content-Language"]
    )
}, name: "custom-cors")

Then set the custom-cors in your Droplet's middleware array.

Config/droplet.json

{
    ...,
    "middleware": [
        ...,
        "custom-cors",
        ...,
    ],
    ...,
}

Note: Please consult the documentation in the source code of the CORSConfiguration for more information about available values for the settings.