rs/cors

AllowedOrigins doesn't block unlisted origins

Nightsee opened this issue · 2 comments

Nightsee commented

I am trying to block all requests comming from other than the specified origin, but the requests still pass.
my code looks like this:

router := httprouter.New() ... c := cors.New(cors.Options{ AllowedOrigins: []string{"http://localhost:3020"}, }) handler := c.Handler(router)

i tried to use AllowOriginFunc and print the origin i get nothing.
i am testing the api from localhost:3030 and it's working. why is that and how can i implement what i want ? thanks

jub0bs commented

@Nightsee I think your issue stems from a misunderstanding of CORS's purpose. Contrary to popular belief, CORS (Cross-Origin Resource Sharing) is not a defence; its purpose is not to block requests, but to relax the reading (and, in some cases, sending) restrictions that the Same-Origin Policy enforces by default in browsers. See also #129.

  • ❤️1
jub0bs commented

@Nightsee If you're happy, don't hesitate to close the issue yourself.

  • 👍1