CORS

import "github.com/thuongh2/go-security/web/cors"

securityhttp.WithCORS(cors.Config{
    AllowedOrigins:   []string{"https://app.example.com"},
    AllowedMethods:   []string{"GET", "POST", "PUT", "DELETE"},
    AllowedHeaders:   []string{"Content-Type", "X-CSRF-Token"},
    AllowCredentials: true,
    MaxAge:           86400 * time.Second, // preflight cache duration
})

// Correct: wildcard without credentials
cors.Config{
    AllowedOrigins: []string{"*"},
    AllowedMethods: []string{"GET"},
    // AllowCredentials omitted — defaults false
}

// ERROR at New(): credentials + wildcard origin is forbidden
cors.Config{
    AllowedOrigins:   []string{"*"},
    AllowCredentials: true,  // ← cors.New returns ErrCredentialsWildcard
}

// ERROR at New(): credentials + the literal "null" origin is also forbidden
cors.Config{
    AllowedOrigins:   []string{"null"},
    AllowCredentials: true,  // ← cors.New returns ErrCredentialsNullOrigin
}

cors.Config{
    OriginFunc: func(origin string) bool {
        return strings.HasSuffix(origin, ".example.com")
    },
    AllowCredentials: true,
}

cors.Config{
    AllowedHeaders: []string{"Content-Type", "X-CSRF-Token"},
}

cors.Config{
    ExposedHeaders: []string{"X-Request-ID", "X-Rate-Limit-Remaining"},
}