How does cors work with poem-openapi?

[liang-kang]

I just try to add cors in openapi/hello-world, just as below:

    Server::new(TcpListener::bind("127.0.0.1:3000"))
        .run(Route::new().nest("/api", api_service).nest("/", ui).with(Cors::new().allow_origin("*")))
        .await

And then test by curl:

curl -I "http://localhost:3000/api/hello"
HTTP/1.1 200 OK
content-type: text/plain
content-length: 0
date: Thu, 06 Jan 2022 03:12:47 GMT

There is no access-control-allow-origin: * info in head.

[sunli829]

The allow_origin method does not support *, if you do not add any origin, it is equivalent to allowing all.

Server::new(TcpListener::bind("127.0.0.1:3000"))
        .run(Route::new().nest("/api", api_service).nest("/", ui).with(Cors::new()))
        .await

[liang-kang]

Removed allow_origin, and then testing by curl.
There is nothing changed in head info.

[sunli829]

Have you set the Origin header?

[liang-kang]

No, I have not changed other codes in example.

How to set the Origin header?

[sunli829]

If the request does not have the Origin header, means it is not a cross-domain request and there will be no access-control-allow-origin header in the response.

curl -I "http://localhost:3000/api/hello" -H "Origin: xxxx"

[liang-kang]

Got it!
Thanks!