https://github.com/gin-contrib/cors
Official CORS gin's middleware
https://github.com/gin-contrib/cors
Last synced: 7 days ago
JSON representation
Official CORS gin's middleware
- Host: GitHub
- URL: https://github.com/gin-contrib/cors
- Owner: gin-contrib
- License: mit
- Created: 2015-11-09T12:31:10.000Z (over 9 years ago)
- Default Branch: master
- Last Pushed: 2025-05-06T00:10:02.000Z (16 days ago)
- Last Synced: 2025-05-07T21:58:11.018Z (14 days ago)
- Language: Go
- Homepage: https://gin-gonic.github.io/gin/
- Size: 187 KB
- Stars: 1,875
- Watchers: 13
- Forks: 184
- Open Issues: 33
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
- awesome-gin - gin-contrib/cors
README
# CORS gin's middleware
[](https://github.com/gin-contrib/cors/actions/workflows/go.yml)
[](https://codecov.io/gh/gin-contrib/cors)
[](https://goreportcard.com/report/github.com/gin-contrib/cors)
[](https://godoc.org/github.com/gin-contrib/cors)
Gin middleware/handler to enable CORS support.
## Usage
### Start using it
Download and install it:
```sh
go get github.com/gin-contrib/cors
```
Import it in your code:
```go
import "github.com/gin-contrib/cors"
```
### Canonical example
```go
package main
import (
"time"
"github.com/gin-contrib/cors"
"github.com/gin-gonic/gin"
)
func main() {
router := gin.Default()
// CORS for https://foo.com and https://github.com origins, allowing:
// - PUT and PATCH methods
// - Origin header
// - Credentials share
// - Preflight requests cached for 12 hours
router.Use(cors.New(cors.Config{
AllowOrigins: []string{"https://foo.com"},
AllowMethods: []string{"PUT", "PATCH"},
AllowHeaders: []string{"Origin"},
ExposeHeaders: []string{"Content-Length"},
AllowCredentials: true,
AllowOriginFunc: func(origin string) bool {
return origin == "https://github.com"
},
MaxAge: 12 * time.Hour,
}))
router.Run()
}
```
### Using DefaultConfig as start point
```go
func main() {
router := gin.Default()
// - No origin allowed by default
// - GET,POST, PUT, HEAD methods
// - Credentials share disabled
// - Preflight requests cached for 12 hours
config := cors.DefaultConfig()
config.AllowOrigins = []string{"http://google.com"}
// config.AllowOrigins = []string{"http://google.com", "http://facebook.com"}
// config.AllowAllOrigins = true
router.Use(cors.New(config))
router.Run()
}
```
Note: while Default() allows all origins, DefaultConfig() does not and you will still have to use AllowAllOrigins.
### Default() allows all origins
```go
func main() {
router := gin.Default()
// same as
// config := cors.DefaultConfig()
// config.AllowAllOrigins = true
// router.Use(cors.New(config))
router.Use(cors.Default())
router.Run()
}
```
Using all origins disables the ability for Gin to set cookies for clients. When dealing with credentials, don't allow all origins.