CORS for Router or Controller

[PabloExperimental]

Hi I'm creating an application using Litestar and I noticed that in the documentation is mentioned that is possible to add CORSMiddleware to Litestar app instance. Is it possible to possible to pass CORSConfig or CORSMiddleware to a Router or a Controller? Or do I have to create an "ad hoc" Middleware?

[provinzkraut]

Yes, it is. All layers (application, routers, controllers, handlers) accept middleware. You can read more about this here: https://docs.litestar.dev/latest/usage/applications.html#layered-architecture

[dbrnz]

Except CORSMiddleware is deprecated and cors_config is not a Router slot...

[Alc-Alc]

@dbrnz thanks for pointing that out, can I know of a use-case where you would need CORS attached to a different layer? Can it not be controlled via any of the allow_* parameters in CORSConfig that is set at app level?

edit: ignore the comment, I confused this with the exclude parameter in CSRFConfig

[peterschutt]

Here's some reading relevant to the deprecation of CORSMiddleware:

• refactor: CORS handling #3395 (comment)
• refactor: deprecate CORSMiddleware from public interface #3403
• refactor: Make CORS outermost middleware #3400
• refactor: deprecate CORSMiddleware from public interface. #3404

[dbrnz]

Thanks @peterschutt for the clarification.

It appears then that the answer @provinzkraut gave to the OP should have been "No, it isn't possible to pass CORSConfig or CORSMiddleware to a Router or a Controller, CORS can only be specified for the Litestar app instance."