From 781ba91a76eea3b20873014203074dbcc683d31a Mon Sep 17 00:00:00 2001 From: Jose Quintana Date: Thu, 10 Mar 2022 23:03:53 +0100 Subject: [PATCH] docs: cors allowed headers [skip ci] --- docs/content/configuration/environment-variables.md | 3 +++ docs/content/features/cors.md | 20 ++++++++++++++++++++ 2 files changed, 23 insertions(+) diff --git a/docs/content/configuration/environment-variables.md b/docs/content/configuration/environment-variables.md index 383eb41..043a18d 100644 --- a/docs/content/configuration/environment-variables.md +++ b/docs/content/configuration/environment-variables.md @@ -45,6 +45,9 @@ Specify the file path to read the private key. Default empty (disabled). ### SERVER_CORS_ALLOW_ORIGINS Specify a optional CORS list of allowed origin hosts separated by comas. Host ports or protocols aren't being checked. Use an asterisk (*) to allow any host. Default empty (disabled). +### SERVER_CORS_ALLOW_HEADERS +Specify an optional CORS list of allowed HTTP headers separated by comas. It requires `SERVER_CORS_ALLOW_ORIGINS` to be used along with. Default `origin, content-type`. + ### SERVER_COMPRESSION `Gzip`, `Deflate` or `Brotli` compression on demand determined by the `Accept-Encoding` header and applied to text-based web file types only. See [ad-hoc mime-type list](https://github.com/joseluisq/static-web-server/blob/master/src/compression.rs#L20). Default `true` (enabled). diff --git a/docs/content/features/cors.md b/docs/content/features/cors.md index 787bfcd..07a8564 100644 --- a/docs/content/features/cors.md +++ b/docs/content/features/cors.md @@ -18,3 +18,23 @@ static-web-server \ # Or use an asterisk to allow any host # --cors-allow-origins "*" ``` + +## Allowed headers + +The server also supports a list of [CORS allowed headers](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Headers) separated by comas. + +This feature depends on `--cors-allow-origins` to be used along with this feature. It can be controlled by the string `-j, --cors-allow-headers` option or the equivalent [SERVER_CORS_ALLOW_HEADERS](./../configuration/environment-variables.md#server_cors_allow_headers) env. + +!!! info "Tips" + - The default allowed headers value is `origin, content-type`. + - The server also supports [preflight requests](https://developer.mozilla.org/en-US/docs/Glossary/Preflight_request) via the `OPTIONS` method. See [Preflighted requests in CORS](./../http-methods/#preflighted-requests-in-cors). + +Below an example of how to CORS. + +```sh +static-web-server \ + --port 8787 \ + --root ./my-public-dir \ + --cors-allow-origins "https://domain.com" + --cors-allow-headers "origin, content-type, x-requested-with" +``` -- libgit2 1.7.2