132 option to set the allowed cors headers

documentation/05_advanced_features.md

@@ -291,12 +291,21 @@ const moduleImporter = async (specifier: string) => import(specifier);
 
 startServer(moduleImporter).then(server =>
 {
-    server.addMiddleware(new CorsMiddleware('https://jitar.dev'));
+    //server.addMiddleware(new CorsMiddleware()); // allow all origins and headers
+    //server.addMiddleware(new CorsMiddleware('https://jitar.dev')); // allow specific origin and all headers
+    server.addMiddleware(new CorsMiddleware('https://jitar.dev', 'Content-Type, Authorization')); // allow specific origin and headers
 });
 ```
 
+The first argument sets the [Access-Control-Allow-Origin](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Origin) header. This header only supports a single origin or a wildcard. The latter is the default when no origin is provided.
+
+The second argument sets the [Access-Control-Allow-Headers](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Headers) header. This header supports a comma separated list of headers or a wildcard. The latter is the default when no headers are provided.
+
 {:.alert-info}
-The CORS middleware only supports a single origin or a wildcard. The latter is the default when no origin is provided.
+The [Access-Control-Allow-Methods](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Methods) header is always set to GET and POST because these are by default supported by the [RPC API](#rpc).
+
+{:.alert-warning}
+The [RPC API](#rpc) does not provide custom headers set by middleware in OPTIONS requests. This means that CORS preflight requests are not supported yet. Don't hesitate to create a [feature request](https://github.com/MaskingTechnology/jitar/issues/new/choose) if you need it. This helps up prioritize our time.
 
 ---
 

packages/jitar/src/runtime/middleware/CorsMiddleware.ts

@@ -5,12 +5,14 @@ import NextHandler from '../types/NextHandler.js';
 
 export default class CorsMiddleware implements Middleware
 {
-    #origin: string;
-    #methods = ['GET', 'POST'];
+    #allowOrigin: string;
+    #allowMethods = 'GET, POST';
+    #allowHeaders: string;
 
-    constructor(origin = '*')
+    constructor(origin = '*', headers = '*')
     {
-        this.#origin = origin;
+        this.#allowOrigin = origin;
+        this.#allowHeaders = headers;
     }
 
     async handle(fqn: string, version: Version, args: Map<string, unknown>, headers: Map<string, string>, next: NextHandler): Promise<unknown>
@@ -24,7 +26,8 @@ export default class CorsMiddleware implements Middleware
 
     #setHeaders(headers: Map<string, string>): void
     {
-        headers.set('Access-Control-Allow-Origin', this.#origin);
-        headers.set('Access-Control-Allow-Methods', this.#methods.join(', '));
+        headers.set('Access-Control-Allow-Origin', this.#allowOrigin);
+        headers.set('Access-Control-Allow-Methods', this.#allowMethods);
+        headers.set('Access-Control-Allow-Headers', this.#allowHeaders);
     }
 }