Package: quart-cors
Quart-CORS is an extension forQuartto enable and controlCross
Origin Resource Sharing, CORS (also
known as access control).CORS is required to share resources in browsers due to theSame
Origin Policywhich prevents resources being used from a different origin. An origin
in this case is defined as the scheme, host and port combined and a
resource corresponds to a path.In practice the Same Origin Policy means that a browser visitinghttp://quart.comwill prevent the response ofGEThttp://api.combeing read. It will also prevent requests such asPOSThttp://api.com. Note that CORS applies to browser initiated
requests, non-browser clients such asrequestsare not subject to
CORS restrictions.CORS allows a server to indicate to a browser that certain resources
can be used, contrary to the Same Origin Policy. It does so via
access-control headers that inform the browser how the resource can be
used. For GET requests these headers are sent in the response. For
non-GET requests the browser must ask the server for the
access-control headers before sending the actual request, it does so
via a preflight OPTIONS request.The Same Origin Policy does not apply to WebSockets, and hence there
is no need for CORS. Instead the server alone is responsible for
deciding if the WebSocket is allowed and it should do so by inspecting
the WebSocket-request origin header.Simple (GET) requests should return CORS headers specifying the
origins that are allowed to use the resource (response). This can be
any origin,*(wildcard), or a list of specific origins. The
response should also include a CORS header specifying whether
response-credentials e.g. cookies can be used. Note that if credential
sharing is allowed the allowed origins must be specific and not a
wildcard.Preflight requests should return CORS headers specifying the origins
allowed to use the resource, the methods and headers allowed to be
sent in a request to the resource, whether response credentials can be
used, and finally which response headers can be used.Note that certain actions are allowed in the Same Origin Policy such
as embedding e.g.<imgsrc="http://api.com/img.gif">and simple
POSTs. For the purposes of this readme though these complications are
ignored.The CORS access control response headers are,Header nameMeaningAccess-Control-Allow-OriginOrigins that are allowed to use the resource.Access-Control-Allow-CredentialsCan credentials be shared.Access-Control-Allow-MethodsMethods that may be used in requests to the resource.Access-Control-Allow-HeadersHeaders that may be sent in requests to the resource.Access-Control-Expose-HeadersHeaders that may be read in the response from the resource.Access-Control-Max-AgeMaximum age to cache the CORS headers for the resource.Quart-CORS uses the same naming (without the Access-Control prefix)
for it’s arguments and settings when they relate to the same meaning.UsageTo add CORS access control headers to all of the routes in the
application, simply apply thecorsfunction to the application, or
to a specific blueprint,app=Quart(__name__)app=cors(app,**settings)blueprint=Blueprint(__name__)blueprint=cors(blueprint,**settings)alternatively if you wish to add CORS selectively by resource, apply
theroute_corsfunction to a route, or thewebsocket_corsfunction to a WebSocket,@app.route('/')@route_cors(**settings)asyncdefhandler():...@app.websocket('/')@websocket_cors(allow_origin=...)asyncdefhandler():...Thesettingsare these arguments,Argumenttypeallow_originUnion[Set[Union[Pattern, str]], Union[Pattern, str]]allow_credentialsboolallow_methodsUnion[Set[str], str]allow_headersUnion[Set[str], str]expose_headersUnion[Set[str], str]max_ageUnion[int, flot, timedelta]which correspond to the CORS headers noted above. Note that all
settings are optional and defaults can be specified in the application
configuration,Configuration keytypeQUART_CORS_ALLOW_ORIGINSet[Union[Pattern, str]]QUART_CORS_ALLOW_CREDENTIALSboolQUART_CORS_ALLOW_METHODSSet[str]QUART_CORS_ALLOW_HEADERSSet[str]QUART_CORS_EXPOSE_HEADERSSet[str]QUART_CORS_MAX_AGEfloatThewebsocket_corsdecorator only takes anallow_originargument which defines the origins that are allowed to use the
WebSocket. A WebSocket request from a disallowed origin will be
responded to with a 400 response.Theallow_originorigins should be the origin only (no path, query
strings or fragments) i.e.https://quart.comnothttps://quart.com/.Thecors_exemptdecorator can be used in conjunction withcorsto exempt a websocket handler or view function from cors.Simple examplesTo allow an app to be used from any origin (not recommended as it is
too permissive),app=Quart(__name__)app=cors(app,allow_origin="*")To allow a route or WebSocket to be used from another specific domain,https://quart.com,@app.route('/')@route_cors(allow_origin="https://quart.com")asyncdefhandler():...@app.websocket('/')@websocket_cors(allow_origin="https://quart.com")asyncdefhandler():...To allow a route or WebSocket to be used from any subdomain (but not
the domain itself) ofquart.com,@app.route('/')@route_cors(allow_origin=re.compile(r"https:\/\/.*\.quart\.com"))asyncdefhandler():...@app.websocket('/')@websocket_cors(allow_origin=re.compile(r"https:\/\/.*\.quart\.com"))asyncdefhandler():...To allow a JSON POST request to an API route, fromhttps://quart.com,@app.route('/',methods=["POST"])@route_cors(allow_headers=["content-type"],allow_methods=["POST"],allow_origin=["https://quart.com"],)asyncdefhandler():data=awaitrequest.get_json()...ContributingQuart-CORS is developed onGitHub. You are very welcome to
openissuesor
proposemerge requests.TestingThe best way to test Quart-CORS is with Tox,$pipinstalltox$toxthis will check the code style and run the tests.HelpThis README is the best place to start, after that try opening anissue.