{"id":18474425,"url":"https://github.com/pgjones/quart-cors","last_synced_at":"2025-04-05T11:09:35.434Z","repository":{"id":51686283,"uuid":"478032794","full_name":"pgjones/quart-cors","owner":"pgjones","description":"Quart-CORS is an extension for Quart to enable and control Cross Origin Resource Sharing, CORS.","archived":false,"fork":false,"pushed_at":"2024-12-27T20:33:09.000Z","size":78,"stargazers_count":31,"open_issues_count":2,"forks_count":7,"subscribers_count":2,"default_branch":"main","last_synced_at":"2025-03-29T10:08:29.173Z","etag":null,"topics":["quart"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/pgjones.png","metadata":{"files":{"readme":"README.rst","changelog":"CHANGELOG.rst","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2022-04-05T08:10:17.000Z","updated_at":"2025-03-26T18:45:22.000Z","dependencies_parsed_at":"2024-12-23T10:27:25.953Z","dependency_job_id":"bab42053-d145-4c1f-b441-f702ec56d5bd","html_url":"https://github.com/pgjones/quart-cors","commit_stats":null,"previous_names":[],"tags_count":11,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/pgjones%2Fquart-cors","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/pgjones%2Fquart-cors/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/pgjones%2Fquart-cors/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/pgjones%2Fquart-cors/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/pgjones","download_url":"https://codeload.github.com/pgjones/quart-cors/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":247325693,"owners_count":20920714,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["quart"],"created_at":"2024-11-06T10:29:25.837Z","updated_at":"2025-04-05T11:09:35.410Z","avatar_url":"https://github.com/pgjones.png","language":"Python","readme":"Quart-CORS\n==========\n\n|Build Status| |pypi| |python| |license|\n\nQuart-CORS is an extension for `Quart\n\u003chttps://github.com/pgjones/quart\u003e`_ to enable and control `Cross\nOrigin Resource Sharing \u003chttp://www.w3.org/TR/cors/\u003e`_, CORS (also\nknown as access control).\n\nCORS is required to share resources in browsers due to the `Same\nOrigin Policy \u003chttps://en.wikipedia.org/wiki/Same-origin_policy\u003e`_\nwhich prevents resources being used from a different origin. An origin\nin this case is defined as the scheme, host and port combined and a\nresource corresponds to a path.\n\nIn practice the Same Origin Policy means that a browser visiting\n``http://quart.com`` will prevent the response of ``GET\nhttp://api.com`` being read. It will also prevent requests such as\n``POST http://api.com``. Note that CORS applies to browser initiated\nrequests, non-browser clients such as ``requests`` are not subject to\nCORS restrictions.\n\nCORS allows a server to indicate to a browser that certain resources\ncan be used, contrary to the Same Origin Policy. It does so via\naccess-control headers that inform the browser how the resource can be\nused. For GET requests these headers are sent in the response. For\nnon-GET requests the browser must ask the server for the\naccess-control headers before sending the actual request, it does so\nvia a preflight OPTIONS request.\n\nThe Same Origin Policy does not apply to WebSockets, and hence there\nis no need for CORS. Instead the server alone is responsible for\ndeciding if the WebSocket is allowed and it should do so by inspecting\nthe WebSocket-request origin header.\n\nSimple (GET) requests should return CORS headers specifying the\norigins that are allowed to use the resource (response). This can be\nany origin, ``*`` (wildcard), or a list of specific origins. The\nresponse should also include a CORS header specifying whether\nresponse-credentials e.g. cookies can be used. Note that if credential\nsharing is allowed the allowed origins must be specific and not a\nwildcard.\n\nPreflight requests should return CORS headers specifying the origins\nallowed to use the resource, the methods and headers allowed to be\nsent in a request to the resource, whether response credentials can be\nused, and finally which response headers can be used.\n\nNote that certain actions are allowed in the Same Origin Policy such\nas embedding e.g. ``\u003cimg src=\"http://api.com/img.gif\"\u003e`` and simple\nPOSTs. For the purposes of this readme though these complications are\nignored.\n\nThe CORS access control response headers are,\n\n================================ ===========================================================\nHeader name                      Meaning\n-------------------------------- -----------------------------------------------------------\nAccess-Control-Allow-Origin      Origins that are allowed to use the resource.\nAccess-Control-Allow-Credentials Can credentials be shared.\nAccess-Control-Allow-Methods     Methods that may be used in requests to the resource.\nAccess-Control-Allow-Headers     Headers that may be sent in requests to the resource.\nAccess-Control-Expose-Headers    Headers that may be read in the response from the resource.\nAccess-Control-Max-Age           Maximum age to cache the CORS headers for the resource.\n================================ ===========================================================\n\nQuart-CORS uses the same naming (without the Access-Control prefix)\nfor it's arguments and settings when they relate to the same meaning.\n\n\nInstallation\n------------\n\nQuart-CORS can be installed using pip or your favorite python package manager:\n\n.. code-block:: console\n\n    pip install quart-cors\n\n\nUsage\n-----\n\nTo add CORS access control headers to all of the routes in the\napplication, simply apply the ``cors`` function to the application, or\nto a specific blueprint,\n\n.. code-block:: python\n\n    from quart_cors import cors\n\n    app = Quart(__name__)\n    app = cors(app, **settings)\n\n    blueprint = Blueprint(__name__)\n    blueprint = cors(blueprint, **settings)\n\nalternatively if you wish to add CORS selectively by resource, apply\nthe ``route_cors`` function to a route, or the ``websocket_cors``\nfunction to a WebSocket,\n\n.. code-block:: python\n\n    from quart_cors import route_cors\n\n    @app.route('/')\n    @route_cors(**settings)\n    async def handler():\n        ...\n\n    @app.websocket('/')\n    @websocket_cors(allow_origin=...)\n    async def handler():\n        ...\n\nThe ``settings`` are these arguments,\n\n==================== ====================================================\nArgument             type\n-------------------- ----------------------------------------------------\nallow_origin         Union[Set[Union[Pattern, str]], Union[Pattern, str]]\nallow_credentials    bool\nallow_methods        Union[Set[str], str]\nallow_headers        Union[Set[str], str]\nexpose_headers       Union[Set[str], str]\nmax_age              Union[int, flot, timedelta]\nsend_origin_wildcard bool\n==================== ====================================================\n\nwhich correspond to the CORS headers noted above (bar\n``send_origin_wildcard``). The ``send_origin_wildcard`` argument\nspecifies whether to send a wildcard or echo the request origin in the\nallow origin header. Note that all settings are optional and defaults\ncan be specified in the application configuration,\n\n=============================== ========================\nConfiguration key               type\n------------------------------- ------------------------\nQUART_CORS_ALLOW_ORIGIN         Set[Union[Pattern, str]]\nQUART_CORS_ALLOW_CREDENTIALS    bool\nQUART_CORS_ALLOW_METHODS        Set[str]\nQUART_CORS_ALLOW_HEADERS        Set[str]\nQUART_CORS_EXPOSE_HEADERS       Set[str]\nQUART_CORS_MAX_AGE              float\nQUART_CORS_SEND_ORIGIN_WILDCARD bool\n=============================== ========================\n\nThe ``websocket_cors`` decorator only takes ``allow_origin`` and\n``send_origin_wildcard`` arguments which defines the origins that are\nallowed to use the WebSocket and whether a wildcard should be sent in\nthe allow origin header. A WebSocket request from a disallowed origin\nwill be responded to with a 400 response.\n\nThe ``allow_origin`` origins should be the origin only (no path, query\nstrings or fragments) i.e. ``https://quart.com`` not\n``https://quart.com/``.\n\nThe ``cors_exempt`` decorator can be used in conjunction with ``cors``\nto exempt a websocket handler or view function from cors. You can find\na usage example in \"Simple examples\" section down below.\n\nSimple examples\n~~~~~~~~~~~~~~~\n\nTo allow an app to be used from any origin (not recommended as it is\ntoo permissive),\n\n.. code-block:: python\n\n    app = Quart(__name__)\n    app = cors(app, allow_origin=\"*\")\n\nTo allow a route or WebSocket to be used from another specific domain,\n``https://quart.com``,\n\n.. code-block:: python\n\n    @app.route('/')\n    @route_cors(allow_origin=\"https://quart.com\")\n    async def handler():\n        ...\n\n    @app.websocket('/')\n    @websocket_cors(allow_origin=\"https://quart.com\")\n    async def handler():\n        ...\n\nTo allow a route or WebSocket to be used from any subdomain (but not\nthe domain itself) of ``quart.com``,\n\n.. code-block:: python\n\n    @app.route('/')\n    @route_cors(allow_origin=re.compile(r\"https:\\/\\/.*\\.quart\\.com\"))\n    async def handler():\n        ...\n\n    @app.websocket('/')\n    @websocket_cors(allow_origin=re.compile(r\"https:\\/\\/.*\\.quart\\.com\"))\n    async def handler():\n        ...\n\nTo exempt a WebSocket handler from CORS,\n\n.. code-block:: python\n\n    @app.websocket('/')\n    @cors_exempt\n    async def handler():\n        ...\n\nTo allow a JSON POST request to an API route, from ``https://quart.com``,\n\n.. code-block:: python\n\n    @app.route('/', methods=[\"POST\"])\n    @route_cors(\n        allow_headers=[\"content-type\"],\n        allow_methods=[\"POST\"],\n        allow_origin=[\"https://quart.com\"],\n    )\n    async def handler():\n        data = await request.get_json()\n        ...\n\nContributing\n------------\n\nQuart-CORS is developed on `GitHub\n\u003chttps://github.com/pgjones/quart-cors\u003e`_. You are very welcome to\nopen `issues \u003chttps://github.com/pgjones/quart-cors/issues\u003e`_ or\npropose `merge requests\n\u003chttps://github.com/pgjones/quart-cors/merge_requests\u003e`_.\n\nTesting\n~~~~~~~\n\nThe best way to test Quart-CORS is with Tox,\n\n.. code-block:: console\n\n    $ pip install tox\n    $ tox\n\nthis will check the code style and run the tests.\n\nHelp\n----\n\nThis README is the best place to start, after that try opening an\n`issue \u003chttps://github.com/pgjones/quart-cors/issues\u003e`_.\n\n\n.. |Build Status| image:: https://github.com/pgjones/quart-cors/actions/workflows/ci.yml/badge.svg\n   :target: https://github.com/pgjones/quart-cors/commits/main\n\n.. |pypi| image:: https://img.shields.io/pypi/v/quart-cors.svg\n   :target: https://pypi.python.org/pypi/Quart-CORS/\n\n.. |python| image:: https://img.shields.io/pypi/pyversions/quart-cors.svg\n   :target: https://pypi.python.org/pypi/Quart-CORS/\n\n.. |license| image:: https://img.shields.io/badge/license-MIT-blue.svg\n   :target: https://github.com/pgjones/quart-cors/blob/main/LICENSE\n","funding_links":[],"categories":[],"sub_categories":[],"project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fpgjones%2Fquart-cors","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fpgjones%2Fquart-cors","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fpgjones%2Fquart-cors/lists"}