CORS headers

[thekid]

Example allowing direct connections from any host with any headers

$cors= new class() implements Filter {
  public function filter($request, $response, $invokation) {
    $response->header('Access-Control-Allow-Origin', '*');
    $response->header('Access-Control-Allow-Headers', '*');
    if ('OPTIONS' === $request->method()) {
      $response->answer(200);
      return;
    }
    return $invokation->proceed($request, $response);
  }
};

Should there be an implementation for this in web.filters?

[thekid]

See https://ktor.io/docs/server-cors.html#overview

[thekid]

Python

# Configure CORS for browser-based clients
middleware = [
    Middleware(
        CORSMiddleware,
        allow_origins=["*"],  # Allow all origins; use specific origins for security
        allow_methods=["GET", "POST", "DELETE", "OPTIONS"],
        allow_headers=[
            "mcp-protocol-version",
            "mcp-session-id",
            "Authorization",
            "Content-Type",
        ],
        expose_headers=["mcp-session-id"],
    )
]

Source: https://gofastmcp.com/deployment/http

[thekid]

https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CORS