Support for CORS preflight requests

[nkconnor]

Feature Request

Motivation

Communicating with an axum app from the browser is a popular use case and many browsers restrict cross-origin requests by default.

Background

MDN CORS
CORS server flowchart

See Also

CORS PR in tower-http

Related issue on OPTIONS requests #44
Related issue on SPAs #87

Warp "wrapping filter"
Tide middleware
3rd party crate recommended for rocket

Proposal

Add ergonomic support and docs for handling CORS preflight requests.

axum already provides support for setting headers globally or specifically using middleware, however, I'm not sure of an ergonomic way to handle preflight requests. That's an OPTIONS request preceding e.g. a POST request to the same path.

An app could handle this for example by (pseudocode)

let app = route("/user", get(get_user).options(cors_fn));

Since routing precedence (I think?) limits the ability to put a path wildcard OPTIONS at the root of the application, or some part of the application, the developer is required to chain options to every path declaration.

I'm not ready to propose any specific changes or weigh in on alternatives yet as I'm a new user and this an issue I'm encountering.

[davidpdrsn]

The intention is that axum will use tower-rs/tower-http#112 when its merged. I don't think building something specifically for axum is necessary. I generally prefer adding things to tower-http is possible since it makes things usable outside of axum.

[silvioprog]

This feature will be very useful. 🤩

[davidpdrsn]

tower-http now finally has cors support 🥳

[silvioprog]

tower-http now finally has cors support partying_face

Wow, awesome news! Congrats dudes! 🎉