🍮 PudimServer Docs

Module: PudimServer.cors

Support functions for CORS configuration.

cors.createConfig(config?)

Resolves CORS defaults and normalizes input values.

Inputs: config? (optional table with CORS rules).

Output: resolved CORS configuration table.

local cors = require("PudimServer.cors")
local config = cors.createConfig{
  AllowOrigins = {"https://app.example.com"},
  AllowCredentials = true
}

cors.buildHeaders(config, requestOrigin?)

Builds final CORS headers to attach to the HTTP response.

Inputs: config (resolved CORS table), requestOrigin? (optional string).

Output: CORS headers table.

local headers = cors.buildHeaders(config, "https://app.example.com")
print(headers["Access-Control-Allow-Origin"])

cors.preflightResponse(config)

Returns an HTTP 204 response for OPTIONS preflight.

Inputs: config (resolved CORS table).

Output: HTTP preflight response string.

local response = cors.preflightResponse(config)
print(response)

CorsConfig

Fields accepted by cors.createConfig(config?) and server:EnableCors(config?).

FieldTypeDefaultDescription
AllowOriginsstring | string[]"*"Allowed origins. Use "*" for any or a list of specific origins.
AllowMethodsstring | string[]"GET, POST, PUT, DELETE, PATCH, OPTIONS"Allowed HTTP methods.
AllowHeadersstring | string[]"Content-Type, Authorization"Headers the client may send.
ExposeHeadersstring | string[]""Headers exposed to the browser beyond the CORS-safelisted ones.
AllowCredentialsbooleanfalseWhether to include Access-Control-Allow-Credentials: true.
MaxAgenumber86400Preflight cache duration in seconds (24 h by default).
 
server:EnableCors{
  AllowOrigins = {"https://app.example.com"},
  AllowMethods = "GET, POST",
  AllowHeaders = "Content-Type, Authorization, X-Custom",
  AllowCredentials = true,
  MaxAge = 3600
}