lib/cors.js
function corsHeaders (req, res, next) {
  // Get the default CORS response headers as specified in the Swagger API
  let responseHeaders = getResponseHeaders(req);

  // Set each CORS header
  _.each(accessControl, (header) => {
    if (responseHeaders[header] !== undefined) {
      // Set the header to the default value from the Swagger API
      res.set(header, responseHeaders[header]);
    }
    else {
      // Set the header to a sensible default
      switch (header) {
        case accessControl.allowOrigin:
          // By default, allow the origin host. Fallback to wild-card.
          res.set(header, req.get("Origin") || "*");
          break;

        case accessControl.allowMethods:
          if (req.swagger && req.swagger.path) {
            // Return the allowed methods for this Swagger path
            res.set(header, util.getAllowedMethods(req.swagger.path));
          }
          else {
            // By default, allow all of the requested methods. Fallback to ALL methods.
            res.set(header, req.get("Access-Control-Request-Method") || swaggerMethods.join(", ").toUpperCase());
          }
          break;

        case accessControl.allowHeaders:
          // By default, allow all of the requested headers
          res.set(header, req.get("Access-Control-Request-Headers") || "");
          break;

        case accessControl.allowCredentials:
          // By default, allow credentials
          res.set(header, true);
          break;

        case accessControl.maxAge:
          // By default, access-control expires immediately.
          res.set(header, 0);
          break;
      }
    }
  });

  if (res.get(accessControl.allowOrigin) === "*") {
    // If Access-Control-Allow-Origin is wild-carded, then Access-Control-Allow-Credentials must be false
    res.set("Access-Control-Allow-Credentials", "false");
  }
  else {
    // If Access-Control-Allow-Origin is set (not wild-carded), then "Vary: Origin" must be set
    res.vary("Origin");
  }

  next();
}
function corsHeaders (req, res, next) {
  // Get the default CORS response headers as specified in the Swagger API
  let responseHeaders = getResponseHeaders(req);

  // Set each CORS header
  _.each(accessControl, (header) => {
    if (responseHeaders[header] !== undefined) {
      // Set the header to the default value from the Swagger API
      res.set(header, responseHeaders[header]);
    }
    else {
      // Set the header to a sensible default
      switch (header) {
        case accessControl.allowOrigin:
          // By default, allow the origin host. Fallback to wild-card.
          res.set(header, req.get("Origin") || "*");
          break;

        case accessControl.allowMethods:
          if (req.swagger && req.swagger.path) {
            // Return the allowed methods for this Swagger path
            res.set(header, util.getAllowedMethods(req.swagger.path));
          }
          else {
            // By default, allow all of the requested methods. Fallback to ALL methods.
            res.set(header, req.get("Access-Control-Request-Method") || swaggerMethods.join(", ").toUpperCase());
          }
          break;

        case accessControl.allowHeaders:
          // By default, allow all of the requested headers
          res.set(header, req.get("Access-Control-Request-Headers") || "");
          break;

        case accessControl.allowCredentials:
          // By default, allow credentials
          res.set(header, true);
          break;

        case accessControl.maxAge:
          // By default, access-control expires immediately.
          res.set(header, 0);
          break;
      }
    }
  });

  if (res.get(accessControl.allowOrigin) === "*") {
    // If Access-Control-Allow-Origin is wild-carded, then Access-Control-Allow-Credentials must be false
    res.set("Access-Control-Allow-Credentials", "false");
  }
  else {
    // If Access-Control-Allow-Origin is set (not wild-carded), then "Vary: Origin" must be set
    res.vary("Origin");
  }

  next();
}
function corsHeaders ( req , res , next ) { // Get the default CORS response headers as specified in the Swagger API let responseHeaders = getResponseHeaders ( req ) ; // Set each CORS header _ . each ( accessControl , ( header ) => { if ( responseHeaders [ header ] !== undefined ) { // Set the header to the default value from the Swagger API res . set ( header , responseHeaders [ header ] ) ; } else { // Set the header to a sensible default switch ( header ) { case accessControl . allowOrigin : // By default, allow the origin host. Fallback to wild-card. res . set ( header , req . get ( "Origin" ) || "*" ) ; break ; case accessControl . allowMethods : if ( req . swagger && req . swagger . path ) { // Return the allowed methods for this Swagger path res . set ( header , util . getAllowedMethods ( req . swagger . path ) ) ; } else { // By default, allow all of the requested methods. Fallback to ALL methods. res . set ( header , req . get ( "Access-Control-Request-Method" ) || swaggerMethods . join ( ", " ) . toUpperCase ( ) ) ; } break ; case accessControl . allowHeaders : // By default, allow all of the requested headers res . set ( header , req . get ( "Access-Control-Request-Headers" ) || "" ) ; break ; case accessControl . allowCredentials : // By default, allow credentials res . set ( header , true ) ; break ; case accessControl . maxAge : // By default, access-control expires immediately. res . set ( header , 0 ) ; break ; } } } ) ; if ( res . get ( accessControl . allowOrigin ) === "*" ) { // If Access-Control-Allow-Origin is wild-carded, then Access-Control-Allow-Credentials must be false res . set ( "Access-Control-Allow-Credentials" , "false" ) ; } else { // If Access-Control-Allow-Origin is set (not wild-carded), then "Vary: Origin" must be set res . vary ( "Origin" ) ; } next ( ) ; }
Sets the CORS headers.  If default values are specified in the Swagger API, then those values are used.
Otherwise, sensible defaults are used.
Sets the CORS headers . If default values are specified in the Swagger API then those values are used . Otherwise sensible defaults are used .