CORS for secure applications

In Chapter 6, Moving to API-First, we introduced the CORS middleware for our backend. We’ve now got to update our new backend service. It will need to respond to OPTION preflight requests, as we discussed in Chapter 6, Moving to API-First, and will also need to identify the URLs that we’re going to allow to talk to our service. This is necessary to ensure our browsers aren’t being tricked into submitting/modifying applications from other sources.

Open up the backend/server.go sample you’ve been running and review the main function:

...
    port := ":8000"
    rtr := mux.NewRouter()
    rtr.Handle("/", appGET()).Methods(http.MethodGet)
    rtr.Handle("/", appPOST()).Methods(http.MethodPost,
                     ...