# Br Cors Public Client

> Configure better-route 0.5.0 CORS and preflight support for public REST clients. Use when adding CorsMiddleware, CorsPolicy, Router::options(), Authorization or Idempotency-Key cross-origin requests, credentialed browser clients, app clients, OPTIONS routes, or debugging failed REST preflight requests.

- **Type:** Skill
- **Install:** `agentstack add skill-lonsdale201-wp-agent-skills-br-cors-public-client`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [Lonsdale201](https://agentstack.voostack.com/s/lonsdale201)
- **Installs:** 0
- **Category:** [Web & Browser](https://agentstack.voostack.com/c/web-and-browser)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [Lonsdale201](https://github.com/Lonsdale201)
- **Source:** https://github.com/Lonsdale201/wp-agent-skills/tree/main/better-route/br-cors-public-client

## Install

```sh
agentstack add skill-lonsdale201-wp-agent-skills-br-cors-public-client
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# better-route: CORS and preflight

Use explicit CORS policy for browser or embedded clients. Do not rely on incidental WordPress defaults when the API needs `Authorization`, `Idempotency-Key`, `If-Match`, `X-Request-ID`, or credentials.

## Global middleware

```php
use BetterRoute\Middleware\Cors\CorsMiddleware;
use BetterRoute\Middleware\Cors\CorsPolicy;

$cors = new CorsMiddleware(new CorsPolicy(
    allowedOrigins: ['https://app.example.com'],
    allowCredentials: true
));

$router->middleware([$cors]);
```

Default allowed headers include:

- `Authorization`
- `Content-Type`
- `Idempotency-Key`
- `If-Match`
- `If-None-Match`
- `X-Request-ID`
- `X-WP-Nonce`

Default exposed headers include `ETag`, `Idempotency-Replayed`, `X-RateLimit-*`, and `X-Request-ID`.

## Explicit preflight route

`CorsMiddleware` can short-circuit `OPTIONS` requests, but the router must register an `OPTIONS` route for that path when WordPress would not otherwise dispatch it.

```php
$router->options('/account/payment-methods', static fn () => null)
    ->middleware([$cors]);
```

`Router::options()` is public by default in 0.5.0. Do not attach business handlers to preflight routes.

## Rules

- Prefer an origin allowlist. Use `*` only for non-credentialed public APIs.
- If `allowCredentials: true`, do not return wildcard origin; `CorsPolicy` echoes the allowed request origin.
- Put CORS early in the middleware list so errors and short-circuits still get headers where possible.
- Keep allowed headers aligned with actual client needs; add custom headers deliberately.
- Keep CORS separate from authentication. CORS says which browser origins may call; auth says who the caller is.

## Source refs

- `libraries/better-route/src/Middleware/Cors/CorsMiddleware.php`
- `libraries/better-route/src/Middleware/Cors/CorsPolicy.php`
- `libraries/better-route/src/Router/Router.php`
- `libraries/better-route/tests/BuiltInMiddlewareTest.php`
- `libraries/better-route/tests/RouterPipelineTest.php`

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [Lonsdale201](https://github.com/Lonsdale201)
- **Source:** [Lonsdale201/wp-agent-skills](https://github.com/Lonsdale201/wp-agent-skills)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-lonsdale201-wp-agent-skills-br-cors-public-client
- Seller: https://agentstack.voostack.com/s/lonsdale201
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.