Class decorator: answer cross-origin requests, declaratively.
@Cors() installs CORS on both dimensions at once: the kernel middleware that decorates every
response, and the adapter hook that still adds the headers when a request fails before the kernel
ever runs. Without one of the two, a browser reads an opaque network error instead of the status
you actually sent.
Nothing is allowed by default: with no origin, no Access-Control-Allow-Origin header is
emitted at all, so an app that merely enables CORS stays same-origin. Name the origins you trust.
Class decorator: answer cross-origin requests, declaratively.
@Cors()installs CORS on both dimensions at once: the kernel middleware that decorates every response, and the adapter hook that still adds the headers when a request fails before the kernel ever runs. Without one of the two, a browser reads an opaque network error instead of the status you actually sent.Nothing is allowed by default: with no
origin, noAccess-Control-Allow-Originheader is emitted at all, so an app that merely enables CORS stays same-origin. Name the origins you trust.