playframework/playframework — pull request #3371 by dwhjames (2014-09-05 03:40:44+00:00)
Title: A filter that implements Cross-Origin Resource Sharing (CORS)

http://www.w3.org/TR/cors/

It can be configured to...

- filter paths by a whitelist of path prefixes
- allow only requests with origins from a whitelist (by default all origins are allowed)
- allow only HTTP methods from a whitelist for preflight requests (by default all methods are allowed)
- allow only HTTP headers from a whitelist for preflight requests (by default all methods are allowed)
- set custom HTTP headers to be exposed in the response (by default no headers are exposed)
- disable/enable support for credentials (by default credentials support is enabled)
- set how long (in seconds) the results of a preflight request can be cached in a preflight result cache (by default 3600 seconds, 1 hour)

The configuration is as follows:
```
cors {
path.prefixes = ["/myresource", ...] # If left undefined, all paths are filtered
allowed {
origins = ["http://...", ...] # If left undefined, all origins are allowed
http {
methods = ["PATCH", ...] # If left undefined, all methods are allowed
headers = ["Custom-Header", ...] # If left undefined, all headers are allowed
}
}
exposed.headers = [...] # empty by default
supports.credentials = true # true by default
preflight.maxage = 3600 # 3600 by default
}
```