developer-delphi-horse-cors

Add CORS support to a Horse web API by registering the HorseCORS middleware to configure allowed origins, credentials, headers, and methods. It automatically handles cross-origin preflight OPTIONS requests by returning a 204 No Content response.

CORS preflight requests fail when authentication middleware blocks OPTIONS requests before CORS headers are applied. You must register the HorseCORS middleware first in the pipeline so preflight requests are handled with a 204 response before auth checks.

Configure allowed origins and headers for cross-origin requests in Horse by using the chainable HorseCORSConfig methods: AllowedOrigin, AllowedCredentials, AllowedHeaders, AllowedMethods, and ExposedHeaders during server initialization.

Yes, the Horse framework requires CORS middleware to be registered as the first middleware in the pipeline. This ordering ensures that preflight OPTIONS requests receive the correct Access-Control-* headers and a 204 response without being blocked by authentication.

A CORS preflight request is an OPTIONS request sent by the browser to check server permissions before the actual cross-origin request. The Horse CORS middleware intercepts and responds to OPTIONS requests with a 204 No Content status and the appropriate Access-Control-* headers.

Yes, you can expose custom response headers to the browser using the ExposedHeaders method within the HorseCORS configuration. This adds the necessary Access-Control-Expose-Headers entry to allow your frontend to read those custom headers.