Class Cors

java.lang.Object

com.codename1.backend.Cors

public final class Cors
extends Object

Cross-origin resource sharing for the application's routes, from cn1.cors.*.

Off unless cn1.cors.allowedOrigins names something, because the default a browser applies -- no cross-origin reads -- is the safe one and turning it off is a decision. A page served from one origin calling the API on another (a web app on its own port, a CDN in front of a separate API host) needs it on.

A preflight is answered only when no handler answered the OPTIONS request itself, so an endpoint with an origin policy of its own -- the MCP endpoint -- keeps it. An ordinary response gains the headers only when its handler set no Access-Control-Allow-Origin of its own.

Method Summary

Modifier and Type	Method	Description
static Cors	policy(String[] origins, String[] methods, String[] headers, String[] exposed, boolean credentials, int maxAge)	The policy of a @CrossOrigin route, built once by the generated router.

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Method Details

policy

public static Cors policy(String[] origins,
 String[] methods,
 String[] headers,
 String[] exposed,
 boolean credentials,
 int maxAge)

The policy of a @CrossOrigin route, built once by the generated router. An empty methods allows every method, since the route already decides which one it answers; origins follow the same rules as cn1.cors.allowedOrigins.

Throws:

IllegalArgumentException - for an origin that is not scheme://host[:port], or credentials allowed with *