Serv.Cors

Documentation

type Policy = Config -> Context -> AccessSet

A CorsPolicy interprets the request's provided Origin and the current routing context to determine how to expose resources to the requestor.

data Context

The CorsContext provides data from which we can make choices about how to respond to CORS requests.

Constructors

Context

Fields

• origin :: Text
• headersExpected :: Set HeaderName
• headersReturned :: Set HeaderName
• methodsAvailable :: Set Verb

data AccessSet

Descrbes what parts of the response should be made available cross-origin. The Monoid product on AccessSets permits all accesses of either of the constituents.

Constructors

AccessSet

Fields

• originAllowed :: Bool
• headersExposed :: Set HeaderName
• credentialsAllowed :: Bool
• methodsAllowed :: Set Verb
• headersAllowed :: Set HeaderName
• maxAge :: Maybe NominalDiffTime

Instances

Monoid AccessSet

The empty access set disallows all CORS access while the product l <> r provides access to a particular part of the response if either l or r does.

Methods

mempty :: AccessSet

mappend :: AccessSet -> AccessSet -> AccessSet

mconcat :: [AccessSet] -> AccessSet

class CorsPolicy m where

Class describing types which describe CORS Policys.

Minimal complete definition

corsPolicy

Methods

corsPolicy :: Proxy m -> Policy

Instances

CorsPolicy PermitAll

Methods

corsPolicy :: Proxy * PermitAll -> Policy

data PermitAll

The PermitAll policy produces the permitAll Policy.

Instances

CorsPolicy PermitAll

Methods

corsPolicy :: Proxy * PermitAll -> Policy

permitAll :: Policy

The most permissive CORS Policy possible. Differs from Wildcard in that it allows credentials. Max age is not provided (so no caching)

wildcard :: Policy

Effects a wildcard policy which provides maximal cross-origin access to all request origins. This disallows credentials use, however.

predicateWhitelist :: (Text -> Bool) -> Policy

Provides access to all origins which pass a predicate