Skip to content

gin-contrib/cors

Folders and files

NameName
Last commit message
Last commit date
Mar 24, 2024
Mar 10, 2024
Nov 25, 2023
Nov 25, 2023
Nov 25, 2023
Oct 20, 2016
Nov 25, 2023
Mar 10, 2024
Mar 10, 2024
Mar 10, 2024
Mar 24, 2024
Mar 24, 2024
Nov 25, 2023

Repository files navigation

CORS gin's middleware

Run Tests codecov Go Report Card GoDoc

Gin middleware/handler to enable CORS support.

Usage

Start using it

Download and install it:

go get github.com/gin-contrib/cors

Import it in your code:

import "github.com/gin-contrib/cors"

Canonical example

package main

import (
  "time"

  "github.com/gin-contrib/cors"
  "github.com/gin-gonic/gin"
)

func main() {
  router := gin.Default()
  // CORS for https://foo.com and https://github.com origins, allowing:
  // - PUT and PATCH methods
  // - Origin header
  // - Credentials share
  // - Preflight requests cached for 12 hours
  router.Use(cors.New(cors.Config{
    AllowOrigins:     []string{"https://foo.com"},
    AllowMethods:     []string{"PUT", "PATCH"},
    AllowHeaders:     []string{"Origin"},
    ExposeHeaders:    []string{"Content-Length"},
    AllowCredentials: true,
    AllowOriginFunc: func(origin string) bool {
      return origin == "https://github.com"
    },
    MaxAge: 12 * time.Hour,
  }))
  router.Run()
}

Using DefaultConfig as start point

func main() {
  router := gin.Default()
  // - No origin allowed by default
  // - GET,POST, PUT, HEAD methods
  // - Credentials share disabled
  // - Preflight requests cached for 12 hours
  config := cors.DefaultConfig()
  config.AllowOrigins = []string{"http://google.com"}
  // config.AllowOrigins = []string{"http://google.com", "http://facebook.com"}
  // config.AllowAllOrigins = true

  router.Use(cors.New(config))
  router.Run()
}

Note: while Default() allows all origins, DefaultConfig() does not and you will still have to use AllowAllOrigins.

Default() allows all origins

func main() {
  router := gin.Default()
  // same as
  // config := cors.DefaultConfig()
  // config.AllowAllOrigins = true
  // router.Use(cors.New(config))
  router.Use(cors.Default())
  router.Run()
}

Using all origins disables the ability for Gin to set cookies for clients. When dealing with credentials, don't allow all origins.