Sanic-CORS

Sanic-CORS is a CORS extension for the Sanic web framework, ported from the well-known flask-cors project. It enables cross-origin AJAX requests by attaching the correct Access-Control-* headers to responses, either globally via a CORS(app) extension call or per-route via a @cross_origin(app) decorator.

The extension follows an ‘enable it fully’ philosophy: rather than requiring fine-tuned header configuration for every use case, it defaults to sensible, secure behavior (credentials disabled by default) while still allowing granular per-resource configuration through a resources dictionary mapping URL patterns to origin/header/method rules.

What You Get

• A CORS(app) extension for globally enabling CORS on all Sanic routes
• A @cross_origin(app) decorator for enabling CORS on individual routes
• Per-resource configuration via a resources={pattern: options} dictionary
• Sanic-Ext integration support for projects already using Sanic’s official extension loader
• Secure-by-default behavior with credentialed (cookie) requests disabled unless explicitly enabled

Common Use Cases

• Allowing a separately hosted frontend SPA to call a Sanic-based JSON API across origins
• Restricting CORS to specific API path prefixes (e.g. /api/*) while leaving other routes unaffected
• Enabling credentialed cross-origin requests for authenticated API calls with explicit origin allow-lists
• Migrating an existing flask-cors-based CORS configuration to a Sanic backend with a familiar API

Under The Hood

Architecture - The package is small and focused: core.py contains the CORS header logic (origin matching, header injection, preflight handling) ported from flask-cors, extension.py wraps that logic as a Sanic extension registered against the app’s middleware/signal hooks, and decorator.py exposes the cross_origin decorator for per-route opt-in. version.py is exec’d directly by setup.py to source the version string, avoiding an import-time dependency during packaging. Tech Stack - Pure Python, built on top of the Sanic ASGI-style framework’s request/response and middleware hooks; packaged with classic setuptools/setup.py rather than a modern pyproject-based build. Code Quality - The tests/ directory mirrors the source layout with dedicated core/, decorator/, and extension/ subdirectories plus a shared base_test.py, indicating structured coverage of each integration surface (extension-level, decorator-level, and header-computation-level). The README calls out several Sanic-version compatibility notices (v21.9, v21.12, v22.9+), reflecting the maintenance burden of tracking a fast-moving upstream framework. API Design - The extension mirrors flask-cors closely, which lowers the learning curve for anyone coming from Flask; the two entry points (global extension vs. per-route decorator) cover the common ‘enable everywhere’ and ‘enable selectively’ cases without requiring users to learn a new configuration model.