actix-cors

actix-cors provides a configurable Cross-Origin Resource Sharing (CORS) middleware for Actix Web, the popular Rust web framework. It handles preflight OPTIONS requests, validates and reflects Origin/Access-Control-* headers according to a builder-configured policy, and supports the experimental Private Network Access draft.

Published from the actix-extras monorepo, which the actix organization maintains alongside actix-web itself as a home for framework-adjacent crates (sessions, identity, rate limiting, HTTP auth, WebSockets). actix-cors is by far the most downloaded crate in that repo, with nearly 19 million total downloads, making it the de facto standard CORS solution for Actix Web applications.

What You Get

• A Cors middleware constructed via a builder pattern for allowed origins, methods, headers, and credentials
• Automatic handling of CORS preflight (OPTIONS) requests without writing custom route handlers
• Permissive (Cors::permissive()) and restrictive builder presets for quick setup versus production lockdown
• Optional support for the draft Private Network Access header via the draft-private-network-access feature flag
• Detailed CorsError types surfaced when a request violates the configured policy

Common Use Cases

• Allowing a separately hosted frontend (SPA on a different origin/port) to call an Actix Web API during development and production
• Locking down which origins, methods, and headers a public API accepts, rejecting everything else automatically
• Supporting credentialed cross-origin requests (cookies/auth headers) with explicit origin allow-lists, since wildcard origins can’t be combined with credentials per the CORS spec
• Quickly unblocking local development with Cors::permissive() before tightening the policy for production

Under The Hood

Architecture - The crate (1,584 lines across src/) separates concerns cleanly: builder.rs implements the fluent configuration API, inner.rs holds the resolved/validated CORS policy used at request time, middleware.rs implements the actual Actix Web Transform/Service that intercepts preflight requests and injects response headers, all_or_some.rs models the allow-list-vs-wildcard duality for origins/headers/methods, and error.rs defines the CorsError variants. Tech Stack - Built directly against actix-web 4’s middleware trait system and actix-utils, using derive_more for error boilerplate, futures-util for async plumbing, and smallvec/once_cell for allocation-conscious header/config storage; part of a Cargo workspace with shared repository/license/edition fields inherited from actix-extras. Code Quality - tests/tests.rs provides integration-level coverage of preflight handling, origin/method/header validation, and credential edge cases, alongside a runnable examples/cors.rs; the crate has shipped over 15 releases since 2020 with an active CI pipeline (GitHub Actions, Codecov) shared across the actix-extras workspace. API Design - The builder API (Cors::default().allowed_origin(...).allowed_methods(...)) mirrors idiomatic Rust builder conventions and Actix Web’s own middleware registration pattern (.wrap()), making it low-friction for anyone already using Actix Web, though correctly reasoning about the CORS spec’s credentials/wildcard interaction still requires the developer to understand CORS semantics, not just the API surface.