adamchainz/django-cors-headers
Django Cors Headers
django-cors-headers is a middleware for Django that manages Cross-Origin Resource Sharing headers to control which external domains can access server resources. It serves as a security component for enforcing access control policies through origin validation and header management.
The project provides capabilities for origin whitelisting using hostnames or regular expressions and supports the Local Network Access specification to permit requests from private networks. It allows for granular control via path-based restrictions and dynamic origin validation driven by a signal system.
The software covers broader security and performance areas including credential management, request filtering, and response header exposure control. It also manages cache coordination by adding the origin to the vary header to prevent content collisions between different cross-origin requests.
Features
- Cross-Origin Resource Sharing (CORS) Policies - Provides mechanisms to restrict or allow web requests from different origins using CORS headers in Django.
- Origin Pattern Matching - Validates request origins against a whitelist using hostnames and regular expressions.
- Cross-Origin Networking - Manages resource fetching and API interactions across different origins to restrict third-party access.
- CORS Header Injection - Implements the automatic injection of CORS headers into HTTP responses via Django middleware.
- CORS Header Management - Provides tools for defining allowed origins, methods, and headers for incoming requests based on the CORS protocol.
- Domain Whitelists - Validates incoming request origins against a predefined whitelist of allowed hostnames or regular expressions.
- API Security - Protects APIs from unauthorized cross-site access by controlling request credentials and allowed headers.
- CORS Middleware - Implements middleware for Django that manages Cross-Origin Resource Sharing policies via HTTP headers.
- Credentialed Cross-Origin Requests - Configures CORS policies to permit the transmission of cookies and authentication credentials in cross-origin requests.
- Path-Based Restrictions - Allows for granular CORS policy enforcement by restricting permissions to specific request paths or URL patterns.
- Dynamic - Implements a signal-based system to evaluate request origins using runtime logic or database lookups.
- Local Network Access Support - Implements headers required by the Local Network Access specification to permit requests from private networks.
- Local Network Access - Provides the required headers to comply with the Local Network Access specification for private network requests.
- URL Path Restrictions - Allows applying specific CORS policies to individual URL patterns rather than a global configuration.
- Authorization Signals - Provides a signal system to determine origin permissions at runtime based on external data.
- CORS Header Exposure - Controls which response headers are visible to client-side scripts using the Access-Control-Expose-Headers header.
- Route-Based CORS Filtering - Filters cross-origin resource sharing restrictions based on specific URL patterns.
- API Development - Handle Cross-Origin Resource Sharing for decoupled frontends.
