Last Update: 2020-04-07 11:37:59 -0700

Documentation for JWT CORS Feature

The jwt_cors feature adds support for Cross-Origin Resource Sharing to Rodauth’s JSON API.

When this feature is used, CORS requests are handled. This includes CORS preflight requests, which are required since Rodauth’s JSON API uses the application/json request content type.

This feature depends on the jwt feature.

Auth Value Methods


For allowed CORS-preflight requests, the value returned in the Access-Control-Allow-Headers header (default: ‘Content-Type, Authorization, Accept’). This specifies which headers can be included in CORS requests.


For allowed CORS-preflight requests, the value returned in the Access-Control-Allow-Methods header (default: ‘POST’). This specifies which methods are allowed in CORS requests.


Which origins are allowed to perform CORS requests. The default is false. This can be a String, Array of Strings, Regexp, or true to allow CORS requests from any domain.


For allowed CORS requests, the value returned in the Access-Control-Expose-Headers header (default: ‘Authorization’). This specifies which headers the browser is allowed to access from a response to a CORS request.


For allowed CORS-preflight requests, the value returned in the Access-Control-Max-Age header (default: 86400). This specifies how long before the information returned should be considered stale and another CORS preflight request made.

Auth Methods


Whether the request should be allowed. This is called for all requests for a Rodauth route that include an Origin header. It should return true or false for whether to specially handle the cross-origin request. By default, uses the jwt_cors_allow_origin setting to check the origin.