gin-contrib/cors

You can use AllowOriginFunc or AllowOriginWithContextFunc to implement custom logic for validating origins. If AllowOriginWithContextFunc is set, it is preferred over AllowOriginFunc.

// Using AllowOriginFunc
config := cors.Config{
  AllowOriginFunc: func(origin string) bool {
    return strings.HasSuffix(origin, "github.com")
  },
}

// Using AllowOriginWithContextFunc
config := cors.Config{
  AllowOriginWithContextFunc: func(c *gin.Context, origin string) bool {
    return c.Request.Header.Get("X-Allow-CORS") == "yes"
  },
}

Instead of defining a full Config struct, you can start with cors.DefaultConfig(). Note that DefaultConfig() does not allow all origins by default (unlike cors.Default()). To allow all origins using this method, you must set AllowAllOrigins = true.

import (
  "github.com/gin-contrib/cors"
  "github.com/gin-gonic/gin"
)

func main() {
  router := gin.Default()
  config := cors.DefaultConfig()
  config.AllowOrigins = []string{"http://google.com"}

  router.Use(cors.New(config))
  router.Run()
}

To allow all origins by default, use cors.Default().

⚠️ Warning: Allowing all origins disables cookies for clients. For credentialed requests, do not allow all origins.

import (
  "github.com/gin-contrib/cors"
  "github.com/gin-gonic/gin"
)

func main() {
  router := gin.Default()
  router.Use(cors.Default()) // All origins allowed by default
  router.Run()
}

To use this middleware in your Gin-based project, install it using go get and import it into your Go files.

go get github.com/gin-contrib/cors

Use cors.New(config) to apply a custom cors.Config struct. This allows you to specify exact origins, methods, headers, and credential support.

import (
  "time"
  "github.com/gin-contrib/cors"
  "github.com/gin-gonic/gin"
)

func main() {
  router := gin.Default()
  router.Use(cors.New(cors.Config{
    AllowOrigins:     []string{"https://foo.com"},
    AllowMethods:     []string{"PUT", "PATCH"},
    AllowHeaders:     []string{"Origin"},
    ExposeHeaders:    []string{"Content-Length"},
    AllowCredentials: true,
    AllowOriginFunc: func(origin string) bool {
      return origin == "https://github.com"
    },
    MaxAge: 12 * time.Hour,
  }))
  router.Run()
}

You can dynamically add methods or headers to an existing cors.Config instance using helper methods.

config.AddAllowMethods("DELETE", "OPTIONS")
config.AddAllowHeaders("X-My-Header")
config.AddExposeHeaders("X-Other-Header")

The Config struct (used by newCors) allows you to define how the CORS middleware handles origins, credentials, and headers.

Key configuration capabilities include:

• Allowing all origins: Set AllowAllOrigins: true or include "*" in the AllowOrigins slice.
• Specifying allowed origins: Use the AllowOrigins slice to list exact origins or patterns.
• Custom origin validation: Use AllowOriginFunc for simple string-based validation or AllowOriginWithContextFunc for validation that requires access to the *gin.Context.
• Handling credentials: Set AllowCredentials to allow cross-origin requests with credentials (like cookies).
• Customizing response status: Set OptionsResponseStatusCode to define the HTTP status returned for preflight OPTIONS requests (defaults to http.StatusNoContent).

If the static AllowOrigins list is insufficient, you can provide custom logic via two function fields in the Config struct:

1. AllowOriginFunc(string) bool: A function that takes the request origin as a string and returns true if it is allowed.
2. AllowOriginWithContextFunc(*gin.Context, string) bool: A function that takes both the *gin.Context and the origin string, allowing for complex validation logic based on request parameters, headers, or context values.