NAME

PAGI::Middleware::CORS - Cross-Origin Resource Sharing middleware

SYNOPSIS

use PAGI::Middleware::Builder;

my $app = builder {
    enable 'CORS',
        origins     => ['https://example.com', 'https://app.example.com'],
        methods     => ['GET', 'POST', 'PUT', 'DELETE'],
        headers     => ['Content-Type', 'Authorization'],
        credentials => 1,
        max_age     => 86400;
    $my_app;
};

DESCRIPTION

PAGI::Middleware::CORS implements Cross-Origin Resource Sharing (CORS) for PAGI applications. It handles preflight OPTIONS requests and adds the appropriate CORS headers to responses.

CONFIGURATION

• origins (default: ['*'])

  Array of allowed origins, or ['*'] for any origin.

• methods (default: ['GET', 'POST', 'PUT', 'DELETE', 'PATCH', 'OPTIONS'])

  Array of allowed HTTP methods.

• headers (default: ['Content-Type', 'Authorization', 'X-Requested-With'])

  Array of allowed request headers.

• expose_headers (default: [])

  Array of headers to expose to the client.

• credentials (default: 0)

  If true, allow credentials (cookies, auth headers).

• max_age (default: 86400)

  Max age for preflight cache in seconds.

PREFLIGHT REQUESTS

When a browser sends a cross-origin request with certain characteristics (custom headers, non-simple methods), it first sends an OPTIONS preflight request. This middleware automatically responds to preflight requests with the appropriate CORS headers.

SEE ALSO

PAGI::Middleware - Base class for middleware