CORS

cors centralizes browser cross-origin behavior at the gateway. It answers OPTIONS preflight requests and adds CORS response headers.

Behavior

For OPTIONS, the middleware reads Origin:

• Allowed origin: returns 204 with Access-Control-Allow-* headers.
• Disallowed origin: returns 403 with Origin not allowed.

For non-preflight responses, it adds Access-Control-Allow-Origin. If allowed_origins includes *, the value is *; otherwise the first configured origin is used.

Configuration

middlewares "cors" {
  type            = "cors"
  allowed_origins = ["https://console.example.com"]
  allowed_methods = ["GET", "POST", "PATCH", "DELETE"]
  allowed_headers = ["Content-Type", "Authorization"]
  max_age         = 3600
}

Notes

• CORS is not authentication; still use auth middleware.
• Avoid the default wildcard for private APIs.
• Put cors before auth when browsers need unauthenticated preflight responses.

Recommended Order

middlewares = ["cors", "auth-jwt", "rate-limit", "headers"]