Apply CORS headers to a specific request. This is useful if you only have a single action that needs CORS headers, and you don't want to pay for conditional checks on every request.

You should note that applyCORS needs to be used before you add any method combinators. For example, the following won't do what you want:

method POST $ applyCORS defaultOptions $ myHandler

This fails to work as CORS requires an OPTIONS request in the preflighting stage, but this would get filtered out. Instead, use

applyCORS defaultOptions $ method POST $ myHandler

Specify the options to use when building CORS headers for a response. Most of these options are Handler actions to allow you to conditionally determine the setting of each header.

Liberal default options. Specifies that:

• All origins may make cross-origin requests
• allow-credentials is true.
• No extra headers beyond simple headers are exposed.
• GET, POST, PUT, DELETE and HEAD are all allowed.
• All request headers are allowed.

All options are determined unconditionally.

Used to specify the contents of the Access-Control-Allow-Origin header.

A set of origins. RFC 6454 specifies that origins are a scheme, host and port, so the OriginSet wrapper around a HashSet ensures that each URI constists of nothing more than this.

A newtype over URI with a Hashable instance.