CORS2

​

Overview

• Wildcard subdomain matching
• Advanced preflight caching
• More control over CORS behavior

​

Installation

import "github.com/go-mizu/mizu/middlewares/cors2"

​

Quick Start

app := mizu.New()

// Allow all subdomains of example.com
app.Use(cors2.New(cors2.Options{
    AllowOriginPatterns: []string{"https://*.example.com"},
}))

​

Configuration

​

Options

​

Examples

​

Wildcard Subdomains

app.Use(cors2.New(cors2.Options{
    AllowOriginPatterns: []string{
        "https://*.example.com",
        "https://*.staging.example.com",
    },
}))

​

Combined Exact and Pattern

app.Use(cors2.New(cors2.Options{
    AllowOrigins: []string{"https://example.com"},
    AllowOriginPatterns: []string{"https://*.example.com"},
}))

​

Full Configuration

app.Use(cors2.New(cors2.Options{
    AllowOrigins:        []string{"https://app.example.com"},
    AllowMethods:        []string{"GET", "POST", "PUT", "DELETE"},
    AllowHeaders:        []string{"Authorization", "Content-Type", "X-Request-ID"},
    ExposeHeaders:       []string{"X-Total-Count", "X-Page-Count"},
    AllowCredentials:    true,
    MaxAge:              12 * time.Hour,
    AllowPrivateNetwork: false,
}))

​

API Reference

​

Functions

// New creates CORS2 middleware with options
func New(opts Options) mizu.Middleware

​

Pattern Syntax

• * matches any sequence of characters
• https://*.example.com matches https://app.example.com, https://api.example.com
• Patterns are matched against the full origin including protocol

​

Technical Details

​

Implementation Overview

• Supports wildcard (*) for all origins
• Implements exact origin matching with case-insensitive comparison
• The matchOrigin function handles both wildcard and exact match scenarios

• Sets Access-Control-Allow-Origin based on the request origin and configured options
• Conditionally sets Access-Control-Allow-Credentials when credentials are enabled
• Applies Access-Control-Expose-Headers for custom headers that should be exposed to the browser

• Detects OPTIONS requests for preflight handling
• Responds with Access-Control-Allow-Methods and Access-Control-Allow-Headers
• Sets Access-Control-Max-Age to cache preflight responses (when configured)
• Returns HTTP 204 (No Content) for preflight requests

• Origin: * (all origins)
• Methods: GET, POST, PUT, DELETE, OPTIONS
• Headers: Content-Type, Authorization
• Credentials: false
• MaxAge: 0 (no caching)

​

Helper Functions

• New(): Creates middleware with default settings
• WithOptions(opts): Creates middleware with custom configuration
• AllowOrigin(origin): Quick setup for a specific origin
• AllowAll(): Permissive setup with extended methods and headers
• AllowCredentials(origin): Enables credentials for a specific origin

​

Best Practices

• Use exact origins when possible for security
• Use patterns only for known subdomain structures
• Set appropriate MaxAge to reduce preflight requests
• Be cautious with credentials and wildcards

​

Testing

​

Related Middlewares

• cors - Basic CORS handling
• secure - Security settings
• helmet - Security headers