loom.rest.cors

Validated CORS settings for the REST layer.

The framework exposes CORS as configuration, not for convenience but because the combination every tutorial suggests is unsafe and Starlette does not refuse it: with allow_origins: ["*"] and allow_credentials: true, Starlette stops sending the wildcard and instead reflects the request’s Origin back together with Access-Control-Allow-Credentials: true. The wildcard silently becomes “any origin, with cookies”.

Binding the settings here makes that shape unrepresentable: it fails at config parse, with the reason.

Classes

CorsConfig(*[, allow_origins, ...])

Validated settings for the CORS middleware.
class loom.rest.cors.CorsConfig(*, allow_origins=(), allow_origin_regex=None, allow_methods=('GET',), allow_headers=(), allow_credentials=False, expose_headers=(), max_age=600)[source]

Bases: LoomFrozenStruct

Validated settings for the CORS middleware.

Binds from the app.rest.cors config section. The section is optional: without it no CORS middleware is mounted and the application behaves exactly as before.

allow_origins

Exact origins allowed to call the API. ["*"] is only accepted when allow_credentials is off.

Type:

tuple[str, …]

allow_origin_regex

Regular expression matching allowed origins. Anchored by Starlette; keep it as narrow as the origin list you would otherwise write.

Type:

str | None

allow_methods

HTTP methods allowed in cross-origin requests.

Type:

tuple[str, …]

allow_headers

Request headers the caller may send.

Type:

tuple[str, …]

allow_credentials

Whether cookies and Authorization may be sent cross-origin. Mutually exclusive with a wildcard origin.

Type:

bool

expose_headers

Response headers the browser may read.

Type:

tuple[str, …]

max_age

Seconds a preflight response may be cached.

Type:

int

Raises:

ConfigError – When a wildcard origin is combined with credentials.

Parameters:

Example YAML:

app:
  rest:
    cors:
      allow_origins: ["https://app.example.com"]
      allow_credentials: true
      allow_methods: [GET, POST]