exhttp: make auto-allow cors behavior optional

Author: tulir

exhttp/json.go

@@ -5,22 +5,30 @@ import (
 	"net/http"
 )
 
+var AutoAllowCORS = true
+
 func WriteJSONResponse(w http.ResponseWriter, httpStatusCode int, jsonData any) {
-	AddCORSHeaders(w)
+	if AutoAllowCORS {
+		AddCORSHeaders(w)
+	}
 	w.Header().Set("Content-Type", "application/json")
 	w.WriteHeader(httpStatusCode)
 	_ = json.NewEncoder(w).Encode(jsonData)
 }
 
 func WriteJSONData(w http.ResponseWriter, httpStatusCode int, data []byte) {
-	AddCORSHeaders(w)
+	if AutoAllowCORS {
+		AddCORSHeaders(w)
+	}
 	w.Header().Set("Content-Type", "application/json")
 	w.WriteHeader(httpStatusCode)
 	_, _ = w.Write(data)
 }
 
 func WriteEmptyJSONResponse(w http.ResponseWriter, httpStatusCode int) {
-	AddCORSHeaders(w)
+	if AutoAllowCORS {
+		AddCORSHeaders(w)
+	}
 	w.Header().Set("Content-Type", "application/json")
 	w.WriteHeader(httpStatusCode)
 	_, _ = w.Write([]byte("{}"))