The jwt_cors feature adds support for Cross-Origin Resource Sharing to Rodauth’s JSON API.
When this feature is used, CORS requests are handled. This includes CORS preflight requests, which are required since Rodauth’s JSON API uses the application/json request content type.
This feature depends on the jwt feature.
For allowed CORS-preflight requests, the value returned in the Access-Control-Allow-Headers header (default: ‘Content-Type, Authorization, Accept’). This specifies which headers can be included in CORS requests.
For allowed CORS-preflight requests, the value returned in the Access-Control-Allow-Methods header (default: ‘POST’). This specifies which methods are allowed in CORS requests.
Which origins are allowed to perform CORS requests. The default is
For allowed CORS requests, the value returned in the Access-Control-Expose-Headers header (default: ‘Authorization’). This specifies which headers the browser is allowed to access from a response to a CORS request.
For allowed CORS-preflight requests, the value returned in the Access-Control-Max-Age header (default: 86400). This specifies how long before the information returned should be considered stale and another CORS preflight request made.
Whether the request should be allowed. This is called for all requests for a