cors

15 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

CORS origin definition

An origin is the combination of protocol (http, https), domain (myapp.com, localhost, localhost.tiangolo.com), and port (80, 443, 8080). Examples of different origins are http://localhost, https://localhost, and http://localhost:8080. All are different origins even though they use localhost, because they use different protocols or ports.

CORS preflight request flow

When a browser frontend running at one origin (for example http://localhost:8080) tries to communicate with a backend at a different origin (for example http://localhost on port 80), the browser sends an HTTP OPTIONS request to the backend. If the backend responds with appropriate CORS headers authorizing the communication, the browser will allow the frontend JavaScript to send its actual request to the backend.

CORS allowed origins list requirement

A backend must maintain a list of allowed origins to enable cross-origin communication. The frontend's origin must be explicitly included in this list for the browser to permit the request.

CORS wildcard limitations

You can declare the allowed origins list as '*' (wildcard) to allow all origins, but this only permits certain types of communication and excludes everything involving credentials like cookies and Authorization headers. For everything to work correctly, it is better to explicitly specify allowed origins.

CORSMiddleware configuration steps

To configure CORS in a FastAPI application: import CORSMiddleware, create a list of allowed origins as strings, and add it as middleware to the FastAPI application. You can also specify whether the backend allows credentials, specific HTTP methods, and specific HTTP headers.

CORSMiddleware allow_origins parameter

The allow_origins parameter accepts a list of origins that should be permitted to make cross-origin requests, for example ['https://example.org', 'https://www.example.org']. You can use ['*'] to allow any origin.

CORSMiddleware allow_origin_regex parameter

The allow_origin_regex parameter accepts a regex string to match against origins that should be permitted to make cross-origin requests, for example 'https://.*\.example\.org'.

CORSMiddleware allow_methods parameter

The allow_methods parameter accepts a list of HTTP methods that should be allowed for cross-origin requests. It defaults to ['GET']. You can use ['*'] to allow all standard methods.

CORSMiddleware allow_headers parameter

The allow_headers parameter accepts a list of HTTP request headers that should be supported for cross-origin requests. It defaults to []. You can use ['*'] to allow all headers. The Accept, Accept-Language, Content-Language, and Content-Type headers are always allowed for simple CORS requests.

CORSMiddleware allow_credentials parameter

The allow_credentials parameter indicates that cookies should be supported for cross-origin requests and defaults to False. None of allow_origins, allow_methods, and allow_headers can be set to ['*'] if allow_credentials is set to True; all of them must be explicitly specified.

CORSMiddleware expose_headers parameter

The expose_headers parameter indicates any response headers that should be made accessible to the browser. It defaults to [].

CORSMiddleware max_age parameter

The max_age parameter sets a maximum time in seconds for browsers to cache CORS responses. It defaults to 600 seconds.

CORS preflight requests definition

CORS preflight requests are any OPTIONS requests with Origin and Access-Control-Request-Method headers. The middleware intercepts these incoming requests and responds with appropriate CORS headers and either a 200 or 400 response for informational purposes.

CORS simple requests definition

Simple requests are any requests with an Origin header. The middleware passes these requests through as normal but includes appropriate CORS headers on the response.

CORSMiddleware import alternative

CORSMiddleware can be imported from either fastapi.middleware.cors or starlette.middleware.cors. FastAPI provides it in fastapi.middleware as a convenience, but most available middlewares come directly from Starlette.

Give your agent this brain