- Bump Elixir requirement to 1.12+, as 1.11 does not get security updates anymore.
- Remove all compilation warnings on Elixir 1.17.
- Remove Dialyzer PLTs from the Hex package. This has no functional impact whatsoever on the library. The PLTs were accidentally published together with the Hex package, which just results in an unnecessarily large Hex package.
- Fix a bug with typespecs and Dialyzer.
- Fix a small issue with preflight requests and the
:passthrough_non_cors_requests
option. - Add the
Corsica.options/0
type.
- Add the
:passthrough_non_cors_requests
option. - Add the
Corsica.sanitized_options/0
andCorsica.options/0
types.
- The
:origins
option is now required. Not having this option used to warn before this version. - The
:log
option was removed in favor ofCorsica.Telemetry
.
- Start emitting Telemetry events (see
Corsica.Telemetry
). - Bump Elixir requirement to 1.11+.
- Response headers that contain lists (such as
access-control-expose-headers
) are now joined without spaces, so what could beGET, POST, DELETE
before is nowGET,POST,DELETE
. Every byte's important.
Upgrading from 1.x to 2.0.0 is a matter of these things:
-
If you're not specifying the
:origins
options when using Corsica, addorigins: "*"
to all the places you're using Corsica (as a plug, throughCorsica.Router
, or through the functions in theCorsica
module). -
If you were using the
:log
option, remove it and call this in your application'sstart/2
callback:log_levels = # what you were using before as the :log option Corsica.Telemetry.attach_default_handler(log_levels: log_levels) Supervisor.start_link(...)
- Add support for the
:allow_private_network
option to control theAccess-Control-Allow-Private-Network
header. - Fix runtime warnings for the
:warn
logger level.
This version drops support for Elixir 1.7 and lower.
- Add support for
{module, function, args}
as a value for the:origins
option.
- Send the
vary: origin
header when the origin is not*
. We were doing this in some cases before but we missed a handful of other cases. See #45.
- Drop the cowboy dependency completely (see #40).
- Warn if the
:origins
option is not explicitly provided. This warning will become an error in future Corsica versions.
- Correctly allow "simple methods" and "simple headers" in preflight requests. See the documentation for the
:allow_methods
and:allow_headers
options.
- Allow
:all
as value for the:allow_methods
and:allow_headers
options.
- Drop support for older Elixir versions and require Elixir
~> 1.3
.
- Improve logs.
- Drop support for anonymous functions in the list of
:origins
(it was a mistake to support that in the first place!). - Change the
:log
option from being a log level orfalse
to being a keyword list with log levels orfalse
for each log "type" (for example,:rejected
or:invalid
).
- Add support for
{module, function}
tuples in the list of:origins
(module.function
will be called with the origin as its argument and will decide if such origin is allowed).
- Fix a bug where options given to a
Corsica.Router
weren't properly escaped and caused a "invalid quoted expression" error.
- Fix a typo in a logged message.
- Logging is now more detailed (for example, it logs what header is missing from
:allow_headers
). - Accept options when a module calls
use Corsica.Router
and make these options overridable in eachCorsica.Router.resource/1-2
macro.
- Add support for logging.