9456a4e922
Some checks failed
CI / Run lints and checks (push) Failing after 47s
CI / Run tests (push) Failing after 1s
CI / Run race tests (push) Failing after 5s
CI / Build CLI docs (push) Has been skipped
CI / Run buf actions (push) Failing after 5s
CodeQL / Analyze (go) (push) Failing after 3s
CodeQL / Analyze (javascript) (push) Failing after 2s
Docker Image Scanners / scanners (push) Failing after 3s
Format / format (push) Failing after 3s
Synchronize Issue Labels / Synchronize Issue Labels (push) Has been skipped
CI / Generate release (push) Has been skipped
CI / Draft newsletter (push) Has been skipped
CI / Pending approval Slack notification (push) Has been skipped
CI / Send newsletter (push) Has been skipped
42 lines
1.7 KiB
Go
42 lines
1.7 KiB
Go
// Copyright © 2025 Ory Corp
|
|
// SPDX-License-Identifier: Apache-2.0
|
|
|
|
package configx
|
|
|
|
import (
|
|
_ "embed"
|
|
"net/http"
|
|
|
|
"github.com/rs/cors"
|
|
|
|
"github.com/ory/x/corsx"
|
|
)
|
|
|
|
const CORSConfigSchemaID = "ory://cors-config"
|
|
|
|
//go:embed cors.schema.json
|
|
var CORSConfigSchema []byte
|
|
|
|
func (p *Provider) CORS(prefix string, defaults cors.Options) (cors.Options, bool) {
|
|
prefix = cleanPrefix(prefix)
|
|
allowedOrigins := p.StringsF(prefix+"cors.allowed_origins", defaults.AllowedOrigins)
|
|
allowInsecureOrigins := p.BoolF("feature_flags.legacy_allow_insecure_origins", false)
|
|
return cors.Options{
|
|
// Populated even though rs/cors ignores it once AllowOriginVaryRequestFunc
|
|
// is set: some consumers read AllowedOrigins directly — notably hydra's
|
|
// oauth2cors.Middleware (which builds its own matcher and treats an empty
|
|
// list as "allow all", a CORS bypass) and oathkeeper's address detection.
|
|
AllowedOrigins: p.StringsF(prefix+"cors.allowed_origins", defaults.AllowedOrigins),
|
|
AllowedMethods: p.StringsF(prefix+"cors.allowed_methods", defaults.AllowedMethods),
|
|
AllowedHeaders: p.StringsF(prefix+"cors.allowed_headers", defaults.AllowedHeaders),
|
|
ExposedHeaders: p.StringsF(prefix+"cors.exposed_headers", defaults.ExposedHeaders),
|
|
AllowCredentials: p.BoolF(prefix+"cors.allow_credentials", defaults.AllowCredentials),
|
|
OptionsPassthrough: p.BoolF(prefix+"cors.options_passthrough", defaults.OptionsPassthrough),
|
|
MaxAge: p.IntF(prefix+"cors.max_age", defaults.MaxAge),
|
|
Debug: p.BoolF(prefix+"cors.debug", defaults.Debug),
|
|
AllowOriginVaryRequestFunc: func(_ *http.Request, origin string) (bool, []string) {
|
|
return corsx.CheckOrigin(allowedOrigins, origin, allowInsecureOrigins), nil
|
|
},
|
|
}, p.Bool(prefix + "cors.enabled")
|
|
}
|