cors_plug

Released to keep tag integrity, equivalent to v3.0.0
Earlier releases pulled

• BREAKING CHANGES / Fixes
  • Remove allow-credentials when set to false (thanks @AntoineAugusti)
  • Don't halt non-CORS OPTIONS requests

• Fixes
  • Use recent versions of Elixir and Erlang for testing (thanks @anthonator)
  • Fix compilation warnings (thanks @thiamsantos)

• Fixes
  • Fixes an issue where the plug would error when no CORS header was set
    (thanks @alexeyds)

• Enhancements
  • Passing a function with arity 2 as origin will pass the conn to the
    function, allowing configuration based on conn (thanks @billionlaughs).
  • You can now pass regexes as part of the list of origins (thanks @gabrielpra1).
• Fixes
  • Fixes an issue where the request was missing the
    access-control-request-headers (thanks @zhhz for the initial report and
    @mfeckie for the fix).

• Enhancements
  • Instead of sending "null" we don't set the headers at all if the origin doesn't match, as suggested by the CORS draft 7.2. Thanks to @YuLeven for initiating the discussion and @slashmili for fixing it. Since we change the return values I consider this a breaking change and released a new major version.
  • You can now set the option send_preflight_response? to false (it's true by default) to stop CorsPlug sending a response to the frelight request. That way the correct headers are set but it's up to you to respond to the request downstream.

v.1.5.2

• Fixes
  • Relax version requirements

• Fixes
  • Send proper return value if Access-Control-Request-Headers is not present.
    (thanks @shivamMg)

• Enhancements
  • Allow configuration of origin via function (thanks @mauricioszabo).

• Enhancements
  • Allows configuration via app config (see README.md, thanks @TokiTori).

• Fixes
  • Return "null" instead of null when no origin matches.

Many thanks to @somlor for the fix!

• Enhancements
  • Allow multiple origins. When configuring you can now pass a list for
    origins (plug: CORSPlug, origin: ~w(example1.com example2.com)).
• Fixes
  • Access-Control-Expose-Headers now works

Both of these have been brought to you by @jer-k - many thanks!

• Fixes
  • Don't override headers. Earlier headers would've been overriden by the
    CORS Plug. Amazing that this hasn't popped up before...

As this makes a backward-incompatible change (no longer overriding headers
this is a new major).