ktor-server-cors/io.ktor.server.plugins.cors/CORSConfig

CORSConfig

class CORSConfig

A configuration for the io.ktor.server.plugins.cors.routing.CORS plugin.

Constructors

fun CORSConfig()

Types

object Companion

Functions

fun allowHeader(header: String)

Allow using a specified header for the actual CORS request.

fun allowHeaders(predicate: (String) -> Boolean)

Allows using headers matching predicate for the actual CORS request.

allowHeadersPrefixed

fun allowHeadersPrefixed(headerPrefix: String)

Allows using headers prefixed with headerPrefix for the actual CORS request.

fun allowHost(host: String, schemes: List<String> = listOf("http"), subDomains: List<String> = emptyList())

Allows requests from the specified domains and schemes. A wildcard is supported for either the host or any subdomain. If you specify a wildcard in the host, you cannot add specific subdomains. Otherwise, you can mix wildcard and non-wildcard subdomains as long as the wildcard is always in front of the domain, e.g. *.sub.domain.com but not sub.*.domain.com.

fun allowMethod(method: HttpMethod)

Adds a specified method to a list of methods allowed by CORS.

fun allowOrigins(predicate: (String) -> Boolean)

Allows using an origin matching predicate for the actual CORS request.

allowXHttpMethodOverride

fun allowXHttpMethodOverride()

Allows using the X-Http-Method-Override header for the actual CORS request.

Allows requests from any host.

fun exposeHeader(header: String)

Allows exposing the header using Access-Control-Expose-Headers. The Access-Control-Expose-Headers header adds the specified headers to the allowlist that JavaScript in browsers can access.

Properties

allowCredentials

var allowCredentials: Boolean = false

Allows passing credential information (such as cookies or authentication information) with cross-origin requests. This property sets the Access-Control-Allow-Credentials response header to true.

allowNonSimpleContentTypes

var allowNonSimpleContentTypes: Boolean = false

Allows sending requests with non-simple content-types. The following content types are considered simple:

allowSameOrigin

var allowSameOrigin: Boolean = true

Allows requests from the same origin.

val exposedHeaders: MutableSet<String>

Exposed HTTP headers that could be accessed by a client.

headerPredicates

val headerPredicates: MutableList<(String) -> Boolean>

If present represents the prefix for headers which are permitted in CORS requests.

val headers: MutableSet<String>

Allowed CORS headers.

val hosts: MutableSet<String>

Allowed CORS hosts.

maxAgeInSeconds

var maxAgeInSeconds: Long

Specifies how long the response to the preflight request can be cached without sending another preflight request.

val methods: MutableSet<HttpMethod>

Allowed CORS HTTP methods.

Extensions

var CORSConfig.maxAgeDuration: Duration

Duration to tell the client to keep CORS options.