Menu
Configure Cross-Origin Resource Sharing (CORS) and security headers. Use for APIs accessed from browsers on different domains.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Guide for using RBatis v4 Rust ORM framework. Use when implementing database CRUD operations, writing dynamic SQL with py_sql or html_sql macros, configuring database connections, managing transactions, implementing interceptors, syncing table structures, or integrating RBatis into Genies microservices. Also use when the user asks about RBatis usage patterns, query building, or database operations in Rust.
Genies 前后端接口规范。Use when designing API contracts, defining field naming conventions, date/time formats, response models, pagination, error handling, or ID strategies between Genies backend and frontend (Web/Android/OHOS).
Guide for using flyway-rs database migration framework with RBatis. Use when implementing database schema migrations, managing SQL changelog files, configuring migration runners, handling multi-database migrations, or integrating database versioning into Genies microservices.
Guide for developing Rust microservices using Genies framework following Java DDD layering principles. Use when creating new microservices, designing aggregate roots, implementing domain events, organizing service layers, setting up Flyway migrations, or structuring a DDD-based Genies project.
Genies framework unified skill hub. Use when you need to find the right skill for any Genies framework task, including authentication, authorization, caching, configuration, database, DDD microservices, Dapr messaging, macros, K8s deployment, testing, API conventions, gateway proxy, or Salvo web framework features. Also use when the user asks about Genies framework capabilities, asks which skill to use, or wants a quick overview of available Genies skills.
Guide for using the Genies Rust microservice framework with DDD and Dapr. Use when developing with Genies, creating aggregates, domain events, Dapr subscriptions, Casbin field-level permissions, configuration management, or when the user asks about Genies framework usage patterns.
| name | salvo-cors |
| description | Configure Cross-Origin Resource Sharing (CORS) and security headers. Use for APIs accessed from browsers on different domains. |
| version | 0.89.3 |
| tags | ["security","cors","cross-origin","headers"] |
This skill helps configure CORS and security headers in Salvo applications.
[dependencies]
salvo = { version = "0.89.3", features = ["cors"] }
use salvo::cors::Cors;
use salvo::prelude::*;
#[tokio::main]
async fn main() {
let cors = Cors::new()
.allow_origin("https://example.com")
.allow_methods(vec!["GET", "POST", "PUT", "DELETE"])
.allow_headers(vec!["Content-Type", "Authorization"])
.into_handler();
let router = Router::new()
.hoop(cors)
.push(Router::with_path("api").get(api_handler));
let acceptor = TcpListener::new("0.0.0.0:8080").bind().await;
Server::new(acceptor).serve(router).await;
}
use salvo::cors::Cors;
// WARNING: Only use in development
let cors = Cors::new()
.allow_origin("*")
.allow_methods(vec!["GET", "POST", "PUT", "DELETE", "OPTIONS"])
.allow_headers(vec!["*"])
.into_handler();
use salvo::cors::Cors;
use salvo::http::Method;
let cors = Cors::new()
.allow_origin(["https://app.example.com", "https://admin.example.com"])
.allow_methods(vec![Method::GET, Method::POST, Method::PUT, Method::DELETE])
.allow_headers(vec!["Authorization", "Content-Type", "X-Requested-With"])
.allow_credentials(true)
.max_age(3600)
.into_handler();
use salvo::cors::Cors;
let cors = Cors::permissive();
let router = Router::new()
.hoop(cors)
.get(handler);
let cors = Cors::new()
.allow_origin("https://app.example.com")
.allow_methods(vec!["GET", "POST"])
.into_handler();
let router = Router::new()
.push(
Router::with_path("api")
.hoop(cors)
.push(Router::with_path("users").get(list_users))
)
.push(
Router::with_path("health")
.get(health_check)
);
use salvo::prelude::*;
#[handler]
async fn security_headers(req: &mut Request, depot: &mut Depot, res: &mut Response, ctrl: &mut FlowCtrl) {
res.headers_mut().insert(
"Content-Security-Policy",
"default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'".parse().unwrap()
);
res.headers_mut().insert(
"Strict-Transport-Security",
"max-age=31536000; includeSubDomains; preload".parse().unwrap()
);
res.headers_mut().insert(
"X-Frame-Options",
"DENY".parse().unwrap()
);
res.headers_mut().insert(
"X-Content-Type-Options",
"nosniff".parse().unwrap()
);
res.headers_mut().insert(
"X-XSS-Protection",
"1; mode=block".parse().unwrap()
);
res.headers_mut().insert(
"Referrer-Policy",
"strict-origin-when-cross-origin".parse().unwrap()
);
ctrl.call_next(req, depot, res).await;
}
use salvo::cors::Cors;
use salvo::http::Method;
use salvo::prelude::*;
#[handler]
async fn security_headers(req: &mut Request, depot: &mut Depot, res: &mut Response, ctrl: &mut FlowCtrl) {
res.headers_mut().insert("X-Content-Type-Options", "nosniff".parse().unwrap());
res.headers_mut().insert("X-Frame-Options", "DENY".parse().unwrap());
res.headers_mut().insert("X-XSS-Protection", "1; mode=block".parse().unwrap());
ctrl.call_next(req, depot, res).await;
}
#[handler]
async fn api_handler() -> Json<serde_json::Value> {
Json(serde_json::json!({"status": "ok"}))
}
#[tokio::main]
async fn main() {
let cors = Cors::new()
.allow_origin(["https://app.example.com"])
.allow_methods(vec![Method::GET, Method::POST, Method::PUT, Method::DELETE])
.allow_headers(vec!["Authorization", "Content-Type"])
.allow_credentials(true)
.max_age(86400)
.into_handler();
let router = Router::new()
.hoop(security_headers)
.hoop(cors)
.push(Router::with_path("api").get(api_handler));
let acceptor = TcpListener::new("0.0.0.0:8080").bind().await;
Server::new(acceptor).serve(router).await;
}
use salvo::cors::Cors;
use salvo::prelude::*;
fn create_cors() -> Cors {
Cors::new()
.allow_origin(|origin: &str, _req: &Request| {
origin.ends_with(".example.com") || origin == "https://example.com"
})
.allow_methods(vec!["GET", "POST"])
.allow_credentials(true)
}