quart-cors 0.1.2

Quart-CORS is an extension for Quart to handle Cross Origin Resource Sharing, CORS (also known as access control).

CORS is required to share resources in browsers due to the Same Origin Policy which prevents resources being read and limits write actions from a different origin. An origin in this case is defined as the scheme, host and port combination.

In practice the Same Origin Policy means that a browser visiting http://quart.com will prevent the response of GET http://api.com being read. It will also prevent requests such as POST http://api.com. Note that embedding is allowed e.g. <img src="http://api.com/img.gif">.

CORS allows the server to indicate to the browser that certain resources can be used. It does so for GET requests by returning headers that indicate the origins that can use the resource whereas for other requests the browser will send a preflight OPTIONS request and then inspect the headers in the response.

Simple (GET) requests should return CORS headers specifying the allowed origins (which can be any origin, *) and whether credentials should be shared. If credentials can be shared the origins must be specific and not a wildcard.

Preflight requests should return CORS headers specifying the allowed origins, methods and headers in the request, whehter credentials should be shared and what response headers should be exposed.

app = Quart(__name__)
app = cors(app)

blueprint = Blueprint(__name__)
blueprint = cors(blueprint)

@blueprint.route('/')
@route_cors()
async def handler():
    ...

$ pipenv install tox
$ tox