:allow_headers - a list of headers (as binaries) or :all. Returned as the value of the access-control-allow-methods header. Request methods are allowed and only the method in access-control-request-method is Defaults to (which means these methodsĪre allowed alongside simple methods). The methods specified by this option are returned in the access-control-allow-methods If the method requested by the preflight request is in this list or isĪ simple method ( HEAD, GET, or POST), then that method is always allowed. Of methods allowed in the access-control-request-method header of preflight :allow_methods - a list of HTTP methods (as binaries) or :all. Header will vary depending on the origin request header then a vary: originīesides :origins, the options that can be passed to the use macro, toĬ/2 and to the Corsica plug (along with their default When Corsica is configured such that the access-control-allow-origin response Origins from the client (which only sees its origin as an allowed origin). This behaviour is intentional: it's compliant with the W3C CORS specificationĪnd at the same time it provides the advantage of 'hiding' all the allowed The value of this header will be the request's origin (which is mirrored). Won't see that value as the value of the access-control-allow-origin header: Origin is allowed and :origins is something different than '*', then you When :origins is '*', theĪccess-control-allow-origin header is set to * as well. The :origins option directly influences the value of theĪccess-control-allow-origin response header. The value of the 'access-control-allow-origin' header The-value-of-the-access-control-allow-origin-header regexes - the actual origin has to match the allowed regex (as per.strings - the actual origin and the allowed origin have to be identical.'matches' means depends on the type of origin. If it 'matches' at least one of the origins specified in :origins. (specified by the 'origin' request header) will be considered a valid origin :origins can be a single value or a list of values. :origins is not provided, an error will be raised. Using a Corsica-based router or when plugging Corsica in a plug pipeline. See the documentation for Corsica.Router for moreĪllowed origins must be specified by passing the :origins options either when In order to do that, you can useĬorsica.Router. When Corsica is used as a plug, it doesn't provide control over which urlsĪre CORS-enabled or with which options. defmodule MyApp.Endpoint do plug Head plug Corsica, max_age : 600, origins : '*', expose_headers : ~w(X-Foo) plug Plug.Static plug MyApp.Router end Respond to requests and halt the pipeline. Router-like plugs also include plugs like Plug.Static, which OPTIONS requests) will often result in 404 errors since no route responds to Phoenix.Router) respond to HTTP verbs as well as request urls, so ifĬorsica is plugged after a router then preflight requests (which are Pipeline before any router-like plug: routers like Plug.Router (or If you want to use Corsica as a plug, be sure to plug it in your plug When Corsica is used as a plug, it intercepts all requests it only sets aīunch of CORS headers for regular CORS requests, but it responds (with a 200 OKĪnd the appropriate headers) to preflight requests. The following is a list of all the CORS response headers supported by Corsica: The response, even if just by a handful of bytes. This isĬompliant with the specification and at the same time it reduces the size of Options to it), the relative header will often not be sent at all. :max_age) are not passed to Corsica (in one of the available ways to pass When some options that are not mandatory and have no default value (such 'Validity of CORS requests' section below. To know what 'invalid' CORS request means, have a look at the As per this specification, Corsicaĭoesn't put any CORS response headers in a connection that holds an invalidĬORS request. Handlers which provide fine control over dealing with CORS requests. a router that can be used in your modules in order to turn them into CORS.a plug that handles CORS requests and responds to preflight requests.low-level functions that let you decide when and where to deal with CORS.Plug-based swiss-army knife for CORS requests.Ĭorsica provides facilities for dealing with Settings View Source Corsica (Corsica v1.2.0)

Preflight phoenix