func (mw *CorsMiddleware) MiddlewareFunc(handler HandlerFunc) HandlerFunc {

	// precompute as much as possible at init time

	mw.allowedMethods = map[string]bool{}
	normedMethods := []string{}
	for _, allowedMethod := range mw.AllowedMethods {
		normed := strings.ToUpper(allowedMethod)
		mw.allowedMethods[normed] = true
		normedMethods = append(normedMethods, normed)
	}
	mw.allowedMethodsCsv = strings.Join(normedMethods, ",")

	mw.allowedHeaders = map[string]bool{}
	normedHeaders := []string{}
	for _, allowedHeader := range mw.AllowedHeaders {
		normed := http.CanonicalHeaderKey(allowedHeader)
		mw.allowedHeaders[normed] = true
		normedHeaders = append(normedHeaders, normed)
	}
	mw.allowedHeadersCsv = strings.Join(normedHeaders, ",")

	return func(writer ResponseWriter, request *Request) {

		corsInfo := request.GetCorsInfo()

		// non CORS requests
		if !corsInfo.IsCors {
			if mw.RejectNonCorsRequests {
				Error(writer, "Non CORS request", http.StatusForbidden)
				return
			}
			// continue, execute the wrapped middleware
			handler(writer, request)
			return
		}

		// Validate the Origin
		if mw.OriginValidator(corsInfo.Origin, request) == false {
			Error(writer, "Invalid Origin", http.StatusForbidden)
			return
		}

		if corsInfo.IsPreflight {

			// check the request methods
			if mw.allowedMethods[corsInfo.AccessControlRequestMethod] == false {
				Error(writer, "Invalid Preflight Request", http.StatusForbidden)
				return
			}

			// check the request headers
			for _, requestedHeader := range corsInfo.AccessControlRequestHeaders {
				if mw.allowedHeaders[requestedHeader] == false {
					Error(writer, "Invalid Preflight Request", http.StatusForbidden)
					return
				}
			}

			writer.Header().Set("Access-Control-Allow-Methods", mw.allowedMethodsCsv)
			writer.Header().Set("Access-Control-Allow-Headers", mw.allowedHeadersCsv)
			writer.Header().Set("Access-Control-Allow-Origin", corsInfo.Origin)
			if mw.AccessControlAllowCredentials == true {
				writer.Header().Set("Access-Control-Allow-Credentials", "true")
			}
			writer.Header().Set("Access-Control-Max-Age", strconv.Itoa(mw.AccessControlMaxAge))
			writer.WriteHeader(http.StatusOK)
			return
		}

		// Non-preflight requests
		for _, exposed := range mw.AccessControlExposeHeaders {
			writer.Header().Add("Access-Control-Expose-Headers", exposed)
		}
		writer.Header().Set("Access-Control-Allow-Origin", corsInfo.Origin)
		if mw.AccessControlAllowCredentials == true {
			writer.Header().Set("Access-Control-Allow-Credentials", "true")
		}
		// continure, execute the wrapped middleware
		handler(writer, request)
		return
	}
}
func (mw *CorsMiddleware) MiddlewareFunc(handler HandlerFunc) HandlerFunc {

	// precompute as much as possible at init time

	mw.allowedMethods = map[string]bool{}
	normedMethods := []string{}
	for _, allowedMethod := range mw.AllowedMethods {
		normed := strings.ToUpper(allowedMethod)
		mw.allowedMethods[normed] = true
		normedMethods = append(normedMethods, normed)
	}
	mw.allowedMethodsCsv = strings.Join(normedMethods, ",")

	mw.allowedHeaders = map[string]bool{}
	normedHeaders := []string{}
	for _, allowedHeader := range mw.AllowedHeaders {
		normed := http.CanonicalHeaderKey(allowedHeader)
		mw.allowedHeaders[normed] = true
		normedHeaders = append(normedHeaders, normed)
	}
	mw.allowedHeadersCsv = strings.Join(normedHeaders, ",")

	return func(writer ResponseWriter, request *Request) {

		corsInfo := request.GetCorsInfo()

		// non CORS requests
		if !corsInfo.IsCors {
			if mw.RejectNonCorsRequests {
				Error(writer, "Non CORS request", http.StatusForbidden)
				return
			}
			// continue, execute the wrapped middleware
			handler(writer, request)
			return
		}

		// Validate the Origin
		if mw.OriginValidator(corsInfo.Origin, request) == false {
			Error(writer, "Invalid Origin", http.StatusForbidden)
			return
		}

		if corsInfo.IsPreflight {

			// check the request methods
			if mw.allowedMethods[corsInfo.AccessControlRequestMethod] == false {
				Error(writer, "Invalid Preflight Request", http.StatusForbidden)
				return
			}

			// check the request headers
			for _, requestedHeader := range corsInfo.AccessControlRequestHeaders {
				if mw.allowedHeaders[requestedHeader] == false {
					Error(writer, "Invalid Preflight Request", http.StatusForbidden)
					return
				}
			}

			writer.Header().Set("Access-Control-Allow-Methods", mw.allowedMethodsCsv)
			writer.Header().Set("Access-Control-Allow-Headers", mw.allowedHeadersCsv)
			writer.Header().Set("Access-Control-Allow-Origin", corsInfo.Origin)
			if mw.AccessControlAllowCredentials == true {
				writer.Header().Set("Access-Control-Allow-Credentials", "true")
			}
			writer.Header().Set("Access-Control-Max-Age", strconv.Itoa(mw.AccessControlMaxAge))
			writer.WriteHeader(http.StatusOK)
			return
		}

		// Non-preflight requests
		for _, exposed := range mw.AccessControlExposeHeaders {
			writer.Header().Add("Access-Control-Expose-Headers", exposed)
		}
		writer.Header().Set("Access-Control-Allow-Origin", corsInfo.Origin)
		if mw.AccessControlAllowCredentials == true {
			writer.Header().Set("Access-Control-Allow-Credentials", "true")
		}
		// continure, execute the wrapped middleware
		handler(writer, request)
		return
	}
}
func ( mw * CorsMiddleware ) MiddlewareFunc ( handler HandlerFunc ) HandlerFunc { // precompute as much as possible at init time mw . allowedMethods = map [ string ] bool { } normedMethods := [ ] string { } for _ , allowedMethod := range mw . AllowedMethods { normed := strings . ToUpper ( allowedMethod ) mw . allowedMethods [ normed ] = true normedMethods = append ( normedMethods , normed ) } mw . allowedMethodsCsv = strings . Join ( normedMethods , " " ) mw . allowedHeaders = map [ string ] bool { } normedHeaders := [ ] string { } for _ , allowedHeader := range mw . AllowedHeaders { normed := http . CanonicalHeaderKey ( allowedHeader ) mw . allowedHeaders [ normed ] = true normedHeaders = append ( normedHeaders , normed ) } mw . allowedHeadersCsv = strings . Join ( normedHeaders , " " ) return func ( writer ResponseWriter , request * Request ) { corsInfo := request . GetCorsInfo ( ) // non CORS requests if ! corsInfo . IsCors { if mw . RejectNonCorsRequests { Error ( writer , " " , http . StatusForbidden ) return } // continue, execute the wrapped middleware handler ( writer , request ) return } // Validate the Origin if mw . OriginValidator ( corsInfo . Origin , request ) == false { Error ( writer , " " , http . StatusForbidden ) return } if corsInfo . IsPreflight { // check the request methods if mw . allowedMethods [ corsInfo . AccessControlRequestMethod ] == false { Error ( writer , " " , http . StatusForbidden ) return } // check the request headers for _ , requestedHeader := range corsInfo . AccessControlRequestHeaders { if mw . allowedHeaders [ requestedHeader ] == false { Error ( writer , " " , http . StatusForbidden ) return } } writer . Header ( ) . Set ( " " , mw . allowedMethodsCsv ) writer . Header ( ) . Set ( " " , mw . allowedHeadersCsv ) writer . Header ( ) . Set ( " " , corsInfo . Origin ) if mw . AccessControlAllowCredentials == true { writer . Header ( ) . Set ( " " , " " ) } writer . Header ( ) . Set ( " " , strconv . Itoa ( mw . AccessControlMaxAge ) ) writer . WriteHeader ( http . StatusOK ) return } // Non-preflight requests for _ , exposed := range mw . AccessControlExposeHeaders { writer . Header ( ) . Add ( " " , exposed ) } writer . Header ( ) . Set ( " " , corsInfo . Origin ) if mw . AccessControlAllowCredentials == true { writer . Header ( ) . Set ( " " , " " ) } // continure, execute the wrapped middleware handler ( writer , request ) return } }
// MiddlewareFunc makes CorsMiddleware implement the Middleware interface.
MiddlewareFunc makes CorsMiddleware implement the Middleware interface .