metosin/reitit

Bundled CORS-support

Open

#236 opened on Mar 11, 2019

View on GitHub
 (9 comments) (22 reactions) (0 assignees)Clojure (1,569 stars) (261 forks)batch import
enhancementhelp wanted

Description

Currently, a third party mw/interceptor is needed for CORS. There should be a fast default mw & interceptor for this. Those could be configured either via route data or via mw/interceptor options. Example data format from https://github.com/metosin/reitit/issues/143#issuecomment-422079662:

{:access-control
 {:allow-origin "http://foo.example"
  :allow-methods #{:get :post :put}
  :allow-credentials true
  :allow-headers #{"X-PINGOTHER" "Content-Type"}
  :expose-headers #{"X-My-Custom-Header" "X-Another-Custom-Header"}
  :max-age 86400}}

Some prior work:

Related issues:

Contributor guide

Tech stack
None
Domain
backendapisecurity
Issue type
feature
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
3
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-3 hours
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
stale
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
clear
Prerequisites
ClojureRing middlewareCORS protocol
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
40
Research direction
Examine the existing middleware implementation in reitit (e.g., reitit ring/src/reitit/ring.clj). Review the ring cors library (https://github.com/r0man/ring cors) and the Pedestal CORS implementation for patterns. Implement a new middleware that accepts options as shown in the example. Ensure it follows the reitit interceptor/middleware pattern and can be configured per route. The linked issues #143 and #85 contain additional discussion on expected behavior.