blackbull.middleware.cors

blackbull.middleware.cors

CORS response headers and preflight handling.

CORS is browser enforcement, not server authorization. Unallowed origins pass through without granting cross-origin access.

CORS

Cross-Origin Resource Sharing (CORS) middleware.

Handles preflight OPTIONS requests and attaches CORS headers to actual cross-origin responses. Requests without an Origin header pass through unchanged.

Parameters:

Name	Type	Description	Default
allow_origins	list[str] | str	Explicit origin strings or ['*'] for wildcard.	'*'
allow_methods	list[str] | None	HTTP methods permitted in cross-origin requests. Defaults to ['GET', 'POST', 'HEAD', 'OPTIONS'].	None
allow_headers	list[str] | str	Request headers permitted; ['*'] allows all.	'*'
allow_credentials	bool	Emit Access-Control-Allow-Credentials: true. Cannot be combined with allow_origins=['*'].	False
expose_headers	list[str] | None	Response headers the browser JS may read.	None
max_age	int | None	Preflight cache lifetime in seconds. None omits the header.	600

Usage::

app = BlackBull()
app.use(CORS(
    allow_origins=['https://myapp.example.com'],
    allow_credentials=True,
    max_age=3600,
))

__init__(allow_origins='*', allow_methods=None, allow_headers='*', allow_credentials=False, expose_headers=None, max_age=600)

Build the middleware.

allow_credentials=True cannot be combined with allow_origins=['*']: the pair raises ValueError. A wildcard origin with credentials is what the CORS specification forbids, not something this middleware chooses to refuse.