CorsBuilder

mach::CorsBuilder

Description

Configures the application’s Cross-Origin Resource Sharing (CORS) policy.

Headers

Primary header:

#include <mach/CorsBuilder.hpp>

Convenience header:

#include <mach/mach.hpp>

Syntax

class CorsBuilder {

public:
    CorsBuilder(const CorsBuilder&) = delete;
    CorsBuilder& operator=(const CorsBuilder&) = delete;

    CorsBuilder(CorsBuilder&&) noexcept = default;
    CorsBuilder& operator=(CorsBuilder&&) noexcept = default;

    ~CorsBuilder() = default;

    CorsBuilder& allowOrigin(std::string_view origin);

    CorsBuilder& allowOrigins(std::initializer_list<std::string_view> origins);

    CorsBuilder& allowMethod(http::Method method);

    CorsBuilder& allowMethods(std::initializer_list<http::Method> methods);

    CorsBuilder& allowHeader(std::string_view header);

    CorsBuilder& allowHeaders(std::initializer_list<std::string_view> headers);

    CorsBuilder& exposeHeader(std::string_view header);

    CorsBuilder& exposeHeaders(std::initializer_list<std::string_view> headers);

    CorsBuilder& allowAnyOrigin();

    CorsBuilder& allowAnyHeader();

    CorsBuilder& allowAnyMethod();

    CorsBuilder& allowCredentials(bool enabled = true);

    CorsBuilder& maxAge(std::chrono::seconds maxAge);
};

Member Functions

Name	Description
`allowOrigin`	Allows the specified origin.
`allowOrigins`	Allows multiple origins.
`allowMethod`	Allows the specified method.
`allowMethods`	Allows multiple methods.
`allowHeader`	Allows the specified request header.
`allowHeaders`	Allows the specified request headers.
`exposeHeader`	Exposes the specified response header.
`exposeHeaders`	Exposes the specified response headers.
`allowAnyOrigin`	Allows requests originating from any origin.
`allowAnyHeader`	Allows any request header.
`allowAnyMethod`	Allows any HTTP method.
`allowCredentials`	Enables or disables support for credentials in CORS requests.
`maxAge`	Sets the maximum age of a preflight response.

Thread Safety

This class is not thread-safe. CORS configuration should be performed from one thread.

Ownership

A CorsBuilder instance is owned by the framework and is provided to the CORS configuration callback.
The configured CORS state is transferred to the application when the callback returns. The builder is valid only for the duration of the callback and must not be stored or used afterward.

Example

builder.addCors([](mach::CorsBuilder& cors) {
    cors.allowOrigin("https://example.com")
        .allowMethods({
            mach::http::Method::Get,
            mach::http::Method::Post
        })
        .allowHeader("Content-Type")
        .allowCredentials();
});