Struct Cors 

pub struct Cors {
    pub allowed_origins: Vec<String>,
    pub allowed_methods: Vec<String>,
    pub allowed_headers: Vec<String>,
    pub expose_headers: Vec<String>,
    pub allow_credentials: bool,
    pub max_age_secs: Option<u64>,
}

Route-scoped CORS policy (DW-027, feature analysis 4.14).

Semantics (frozen; evaluation lives in dataplane::cors):

• allowed_origins is a closed set of exact origins (https://api.example.com, scheme + host + optional port, compared in normalized form: lowercase scheme/host, default port dropped) or the single entry * (any origin). It must be non-empty; * combined with allow_credentials: true is rejected by validation (the Fetch spec forbids wildcard-credentialed responses).
• A PREFLIGHT (OPTIONS + Origin + Access-Control-Request-Method) on a CORS-configured route is answered 204 by the gateway — validated against the policy, never forwarded upstream, and never subject to authn/authz/rate limiting (browsers send preflights without credentials). A preflight that fails validation (origin, method, or requested headers not allowed) still short-circuits: 204 with NO CORS headers, which the browser reads as a failed preflight. A plain OPTIONS without the preflight markers is NOT intercepted; it proxies normally.
• ACTUAL responses on the route carry Access-Control-Allow-Origin (*, or the echoed request origin when the list is specific), Access-Control-Allow-Credentials: true when configured, Access-Control-Expose-Headers when configured, and Vary: Origin (merged into any existing Vary). A request whose Origin is not allowed simply gets no CORS headers — the response passes through as-is (same-origin reads do not consult CORS at all).

Fields

allowed_origins: Vec<String>

Origins allowed to call this route cross-origin: exact origin strings (https://api.example.com, http://localhost:8080) or * (any origin; never together with allow_credentials).

allowed_methods: Vec<String>

Methods allowed for cross-origin requests (preflight echo and actual-request check). Default: the common API set GET/POST/PUT/PATCH/DELETE/HEAD/OPTIONS. Each entry must be a valid HTTP method token; comparison is case-insensitive.

allowed_headers: Vec<String>

Request headers clients may send: exact header names, or * to allow any requested header (never * together with allow_credentials). Validated against the preflight’s Access-Control-Request-Headers list; empty means no headers beyond the CORS-safelisted set are permitted in preflight checks.

expose_headers: Vec<String>

Response headers exposed to the browser (readable by cross-origin client script). Absent: only the CORS-safelisted response headers are exposed.

allow_credentials: bool

Allow credentialed cross-origin requests (cookies, TLS client certificates). Default false. When true, the origin list must be specific (* is rejected by validation) and responses echo the request origin rather than sending *.

max_age_secs: Option<u64>

Access-Control-Max-Age for preflight responses, in seconds (how long the browser may cache the preflight result). Absent: the header is omitted (each preflight hits the gateway).

Trait Implementations

impl Clone for Cors

fn clone(&self) -> Cors

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Cors

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for Cors

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl JsonSchema for Cors

fn schema_name() -> Cow<'static, str>

The name of the generated JSON Schema.

fn schema_id() -> Cow<'static, str>

Returns a string that uniquely identifies the schema produced by this type.

fn json_schema(generator: &mut SchemaGenerator) -> Schema

Generates a JSON Schema for this type.

fn inline_schema() -> bool

Whether JSON Schemas generated for this type should be included directly in parent schemas, rather than being re-used where possible using the $ref keyword.

impl PartialEq for Cors

fn eq(&self, other: &Cors) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for Cors

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for Cors