wai-cors
CORS for WAI
https://github.com/larskuhtz/wai-cors
| LTS Haskell 23.1: | 0.2.7 |
| Stackage Nightly 2024-12-21: | 0.2.7 |
| Latest on Hackage: | 0.2.7 |
wai-cors-0.2.7@sha256:c3309a9c9db001cb5c3c777222ba3389f35c2ec57425731cddf2af8515b204b2,2905Module documentation for 0.2.7
- Network
- Network.Wai
- Network.Wai.Middleware
- Network.Wai
Cross-Origin Resource Sharing (CORS) For Wai
This package provides a Haskell implementation of CORS for WAI that aims to be compliant with http://www.w3.org/TR/cors.
Note On Security
This implementation doesn’t include any server side enforcement. By complying
with the CORS standard it enables the client (i.e. the web browser) to enforce
the CORS policy. For application authors it is strongly recommended to take
into account the security considerations in section 6.3 of the
CORS standard. In particular the application should
check that the value of the Origin header matches the expectations.
Websocket connections don’t support CORS and are ignored by the CORS implementation in this package. However Websocket requests usually (at least for some browsers) include the @Origin@ header. Applications are expected to check the value of this header and respond with an error in case that its content doesn’t match the expectations.
Installation
Assuming the availability of recent versions of GHC and cabal this package is installed via
cabal update
cabal install wai-cors
Usage
The function ‘simpleCors’ enables support of simple cross-origin requests. More advanced CORS policies can be enabled by passing a ‘CorsResourcePolicy’ to the ‘cors’ middleware.
The file examples/Scotty.hs shows how to support simple cross-origin requests (as
defined in http://www.w3.org/TR/cors) in a
scotty application.
{-# LANGUAGE OverloadedStrings #-}
module Main
( main
) where
import Network.Wai.Middleware.Cors
import Web.Scotty
main :: IO ()
main = scotty 8080 $ do
middleware simpleCors
matchAny "/" $ text "Success"
The result of following curl command will include the HTTP response
header Access-Control-Allow-Origin: *.
curl -i http://127.0.0.1:8080 -H 'Origin: 127.0.0.1' -v
Documentation for more general usage can be found in the module Network.Wai.Middleware.Cors.
Test
In order to run the automated test suite PhantomJS (at least version 2.0) must be installed in the system.
cabal install --only-dependencies --enable-tests
cabal test --show-details=streaming
If PhantomJS is not available the tests can be exectued manually in a modern web-browser as follows.
Start the server application:
cd test
ghc -main-is Server Server.hs
./Server
Open the file test/index.html in a modern web-browser. On page load a Javascript
script is exectued that runs the test suite and prints the result on the page.