Struct CorsPlugin 

pub struct CorsPlugin {
    allowed_origins: Vec<String>,
    allowed_methods: Vec<Template>,
    allowed_headers: Vec<Template>,
    max_age: u64,
    allow_credentials: bool,
}

Applies CORS response headers based on the request’s Origin header.

For an allowed origin the plugin sets access-control-allow-origin (echoing the origin, or * when wildcarded) and, when enabled, access-control-allow-credentials. For preflight (OPTIONS) requests it additionally sets the allow-methods/allow-headers/max-age headers, prepares a 204 empty response, and exits through the preflight port — the policy must wire that port (typically straight to client) or compilation rejects it. Does not write to context.message and always succeeds.

Fields

allowed_origins: Vec<String>

Origins granted CORS access; "*" matches any origin. Never templated — semantic tokens (*/origin-echo) stay literal.

allowed_methods: Vec<Template>

Methods advertised in preflight responses. Values support {{namespace.path}} references (no legacy $var interpolation — these headers never supported it, so this sweep must not start).

allowed_headers: Vec<Template>

Request headers advertised in preflight responses; may be "*". Values support {{namespace.path}} references, same as allowed_methods.

max_age: u64

Preflight cache lifetime in seconds (access-control-max-age).

allow_credentials: bool

Whether to emit access-control-allow-credentials: true.

Implementations

impl CorsPlugin

pub fn from_config(config: &HashMap<String, Value>) -> Result<Self, String>

Builds the plugin from node config. Never fails; every key has a default.

Accepted keys:

• allowed_origins (array of strings, default ["*"]) — never templated; semantic tokens (*/origin-echo) stay literal.
• allowed_methods (array of strings, default ["GET", "POST", "PUT", "DELETE", "OPTIONS"]); values support {{namespace.path}} references.
• allowed_headers (array of strings, default ["*"]); values support {{namespace.path}} references.
• max_age (integer seconds, default 3600)
• allow_credentials (bool, default false)

type: cors
config:
  allowed_origins: ["https://app.example.com"]
  allowed_methods: ["GET", "POST"]
  max_age: 600
  allow_credentials: true

fn origin_allowed(&self, origin: &str) -> bool

Returns true when the origin exactly matches an allowed origin or the list contains the "*" wildcard.

Trait Implementations

impl Plugin for CorsPlugin

fn plugin_type(&self) -> &str

Unique identifier for the plugin type (e.g., “proxy-rewrite”, “upstream”). This is also the key its PortSpec is registered under in port_spec.

fn execute<'life0, 'async_trait>( &'life0 self, ctx: Context, ) -> Pin<Box<dyn Future<Output = Result<PluginOutput, PluginExecutionError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait,

Executes the plugin logic against the request/response context.

fn reads_response_body(&self) -> bool

Whether this configured instance reads context.response.body.

fn cache_target(&self) -> Option<CacheTarget>

The cache backend this node writes to, if it is a proxy-cache half.