.\" Man page generated from reStructuredText.
.
.TH "FLASK-CORS" "1" "Oct 08, 2020" "3.0.7" "Flask-Cors"
.SH NAME
flask-cors \- Flask-Cors Documentation
.
.nr rst2man-indent-level 0
.
.de1 rstReportMargin
\\$1 \\n[an-margin]
level \\n[rst2man-indent-level]
level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
-
\\n[rst2man-indent0]
\\n[rst2man-indent1]
\\n[rst2man-indent2]
..
.de1 INDENT
.\" .rstReportMargin pre:
. RS \\$1
. nr rst2man-indent\\n[rst2man-indent-level] \\n[an-margin]
. nr rst2man-indent-level +1
.\" .rstReportMargin post:
..
.de UNINDENT
. RE
.\" indent \\n[an-margin]
.\" old: \\n[rst2man-indent\\n[rst2man-indent-level]]
.nr rst2man-indent-level -1
.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
..
.sp
A Flask extension for handling Cross Origin Resource Sharing (CORS),
making cross\-origin AJAX possible.
.sp
This package has a simple philosophy, when you want to enable CORS, you
wish to enable it for all use cases on a domain. This means no mucking
around with different allowed headers, methods, etc. By default,
submission of cookies across domains is disabled due to the security
implications, please see the documentation for how to enable
credential\(aqed requests, and please make sure you add some sort of
\fI\%CSRF\fP
protection before doing so!
.SH INSTALLATION
.sp
Install the extension with using pip, or easy_install.
.INDENT 0.0
.INDENT 3.5
.sp
.nf
.ft C
$ pip install \-U flask\-cors
.ft P
.fi
.UNINDENT
.UNINDENT
.SH USAGE
.sp
This package exposes a Flask extension which by default enables CORS support on all routes, for all origins and methods. It allows parameterization of all CORS headers on a per\-resource level. The package also contains a decorator, for those who prefer this approach.
.SS Simple Usage
.sp
In the simplest case, initialize the Flask\-Cors extension with default
arguments in order to allow CORS for all domains on all routes. See the
full list of options in the \fI\%documentation\fP\&.
.INDENT 0.0
.INDENT 3.5
.sp
.nf
.ft C
from flask import Flask
from flask_cors import CORS

app = Flask(__name__)
CORS(app)

@app.route("/")
def helloWorld():
  return "Hello, cross\-origin\-world!"
.ft P
.fi
.UNINDENT
.UNINDENT
.SS Resource specific CORS
.sp
Alternatively, you can specify CORS options on a resource and origin
level of granularity by passing a dictionary as the \fIresources\fP option,
mapping paths to a set of options. See the
full list of options in the \fI\%documentation\fP\&.
.INDENT 0.0
.INDENT 3.5
.sp
.nf
.ft C
app = Flask(__name__)
cors = CORS(app, resources={r"/api/*": {"origins": "*"}})

@app.route("/api/v1/users")
def list_users():
  return "user example"
.ft P
.fi
.UNINDENT
.UNINDENT
.SS Route specific CORS via decorator
.sp
This extension also exposes a simple decorator to decorate flask routes
with. Simply add \fB@cross_origin()\fP below a call to Flask\(aqs
\fB@app.route(..)\fP to allow CORS on a given route. See the
full list of options in the \fI\%decorator documentation\fP\&.
.INDENT 0.0
.INDENT 3.5
.sp
.nf
.ft C
@app.route("/")
@cross_origin()
def helloWorld():
  return "Hello, cross\-origin\-world!"
.ft P
.fi
.UNINDENT
.UNINDENT
.SH DOCUMENTATION
.sp
For a full list of options, please see the full
\fI\%documentation\fP
.SH TROUBLESHOOTING
.sp
If things aren\(aqt working as you expect, enable logging to help understand
what is going on under the hood, and why.
.INDENT 0.0
.INDENT 3.5
.sp
.nf
.ft C
logging\&.getLogger(\(aqflask_cors\(aq)\&.level = logging\&.DEBUG
.ft P
.fi
.UNINDENT
.UNINDENT
.SH TESTS
.sp
A simple set of tests is included in \fBtest/\fP\&. To run, install nose,
and simply invoke \fBnosetests\fP or \fBpython setup.py test\fP to exercise
the tests.
.SH CONTRIBUTING
.sp
Questions, comments or improvements? Please create an issue on
\fI\%Github\fP, tweet at
\fI\%@corydolphin\fP or send me an email.
I do my best to include every contribution proposed in any way that I
can.
.SH CREDITS
.sp
This Flask extension is based upon the \fI\%Decorator for the HTTP Access
Control\fP written by Armin
Ronacher.
.SS API Docs
.sp
This package exposes a Flask extension which by default enables CORS support on all routes, for all origins and methods. It allows parameterization of all CORS headers on a per\-resource level. The package also contains a decorator, for those who prefer this approach.
.SS Extension
.sp
This is the suggested approach to enabling CORS. The default configuration
will work well for most use cases.
.INDENT 0.0
.TP
.B class flask_cors.CORS(app=None, **kwargs)
Initializes Cross Origin Resource sharing for the application. The
arguments are identical to \fI\%cross_origin()\fP, with the addition of a
\fIresources\fP parameter. The resources parameter defines a series of regular
expressions for resource paths to match and optionally, the associated
options to be applied to the particular resource. These options are
identical to the arguments to \fI\%cross_origin()\fP\&.
.sp
The settings for CORS are determined in the following order
.INDENT 7.0
.IP 1. 3
Resource level settings (e.g when passed as a dictionary)
.IP 2. 3
Keyword argument settings
.IP 3. 3
App level configuration settings (e.g. CORS_*)
.IP 4. 3
Default settings
.UNINDENT
.sp
Note: as it is possible for multiple regular expressions to match a
resource path, the regular expressions are first sorted by length,
from longest to shortest, in order to attempt to match the most
specific regular expression. This allows the definition of a
number of specific resource options, with a wildcard fallback
for all other resources.
.INDENT 7.0
.TP
.B Parameters
.INDENT 7.0
.IP \(bu 2
\fBresources\fP (\fIdict\fP\fI, \fP\fIiterable\fP\fI or \fP\fIstring\fP) \-\- 
.sp
The series of regular expression and (optionally) associated CORS
options to be applied to the given resource path.
.sp
If the argument is a dictionary, it\(aqs keys must be regular expressions,
and the values must be a dictionary of kwargs, identical to the kwargs
of this function.
.sp
If the argument is a list, it is expected to be a list of regular
expressions, for which the app\-wide configured options are applied.
.sp
If the argument is a string, it is expected to be a regular expression
for which the app\-wide configured options are applied.
.sp
Default : Match all and apply app\-level configuration

.IP \(bu 2
\fBorigins\fP (\fIlist\fP\fI, \fP\fIstring\fP\fI or \fP\fIregex\fP) \-\- 
.sp
The origin, or list of origins to allow requests from.
The origin(s) may be regular expressions, case\-sensitive strings,
or else an asterisk
.sp
Default : \(aq*\(aq

.IP \(bu 2
\fBmethods\fP (\fIlist\fP\fI or \fP\fIstring\fP) \-\- 
.sp
The method or list of methods which the allowed origins are allowed to
access for non\-simple requests.
.sp
Default : [GET, HEAD, POST, OPTIONS, PUT, PATCH, DELETE]

.IP \(bu 2
\fBexpose_headers\fP (\fIlist\fP\fI or \fP\fIstring\fP) \-\- 
.sp
The header or list which are safe to expose to the API of a CORS API
specification.
.sp
Default : None

.IP \(bu 2
\fBallow_headers\fP (\fIlist\fP\fI, \fP\fIstring\fP\fI or \fP\fIregex\fP) \-\- 
.sp
The header or list of header field names which can be used when this
resource is accessed by allowed origins. The header(s) may be regular
expressions, case\-sensitive strings, or else an asterisk.
.sp
Default : \(aq*\(aq, allow all headers

.IP \(bu 2
\fBsupports_credentials\fP (\fIbool\fP) \-\- 
.sp
Allows users to make authenticated requests. If true, injects the
\fIAccess\-Control\-Allow\-Credentials\fP header in responses. This allows
cookies and credentials to be submitted across domains.
.INDENT 2.0
.TP
.B note
This option cannot be used in conjunction with a \(aq*\(aq origin
.UNINDENT
.sp
Default : False

.IP \(bu 2
\fBmax_age\fP (\fItimedelta\fP\fI, \fP\fIinteger\fP\fI, \fP\fIstring\fP\fI or \fP\fINone\fP) \-\- 
.sp
The maximum time for which this CORS request maybe cached. This value
is set as the \fIAccess\-Control\-Max\-Age\fP header.
.sp
Default : None

.IP \(bu 2
\fBsend_wildcard\fP (\fIbool\fP) \-\- 
.sp
If True, and the origins parameter is \fI*\fP, a wildcard
\fIAccess\-Control\-Allow\-Origin\fP header is sent, rather than the
request\(aqs \fIOrigin\fP header.
.sp
Default : False

.IP \(bu 2
\fBvary_header\fP (\fIbool\fP) \-\- 
.sp
If True, the header Vary: Origin will be returned as per the W3
implementation guidelines.
.sp
Setting this header when the \fIAccess\-Control\-Allow\-Origin\fP is
dynamically generated (e.g. when there is more than one allowed
origin, and an Origin than \(aq*\(aq is returned) informs CDNs and other
caches that the CORS headers are dynamic, and cannot be cached.
.sp
If False, the Vary header will never be injected or altered.
.sp
Default : True

.UNINDENT
.UNINDENT
.UNINDENT
.SS Decorator
.sp
If the \fICORS\fP extension does not satisfy your needs, you may find the
decorator useful. It shares options with the extension, and should be simple
to use.
.INDENT 0.0
.TP
.B flask_cors.cross_origin(*args, **kwargs)
This function is the decorator which is used to wrap a Flask route with.
In the simplest case, simply use the default parameters to allow all
origins in what is the most permissive configuration. If this method
modifies state or performs authentication which may be brute\-forced, you
should add some degree of protection, such as Cross Site Forgery
Request protection.
.INDENT 7.0
.TP
.B Parameters
.INDENT 7.0
.IP \(bu 2
\fBorigins\fP (\fIlist\fP\fI, \fP\fIstring\fP\fI or \fP\fIregex\fP) \-\- 
.sp
The origin, or list of origins to allow requests from.
The origin(s) may be regular expressions, case\-sensitive strings,
or else an asterisk
.sp
Default : \(aq*\(aq

.IP \(bu 2
\fBmethods\fP (\fIlist\fP\fI or \fP\fIstring\fP) \-\- 
.sp
The method or list of methods which the allowed origins are allowed to
access for non\-simple requests.
.sp
Default : [GET, HEAD, POST, OPTIONS, PUT, PATCH, DELETE]

.IP \(bu 2
\fBexpose_headers\fP (\fIlist\fP\fI or \fP\fIstring\fP) \-\- 
.sp
The header or list which are safe to expose to the API of a CORS API
specification.
.sp
Default : None

.IP \(bu 2
\fBallow_headers\fP (\fIlist\fP\fI, \fP\fIstring\fP\fI or \fP\fIregex\fP) \-\- 
.sp
The header or list of header field names which can be used when this
resource is accessed by allowed origins. The header(s) may be regular
expressions, case\-sensitive strings, or else an asterisk.
.sp
Default : \(aq*\(aq, allow all headers

.IP \(bu 2
\fBsupports_credentials\fP (\fIbool\fP) \-\- 
.sp
Allows users to make authenticated requests. If true, injects the
\fIAccess\-Control\-Allow\-Credentials\fP header in responses. This allows
cookies and credentials to be submitted across domains.
.INDENT 2.0
.TP
.B note
This option cannot be used in conjunction with a \(aq*\(aq origin
.UNINDENT
.sp
Default : False

.IP \(bu 2
\fBmax_age\fP (\fItimedelta\fP\fI, \fP\fIinteger\fP\fI, \fP\fIstring\fP\fI or \fP\fINone\fP) \-\- 
.sp
The maximum time for which this CORS request maybe cached. This value
is set as the \fIAccess\-Control\-Max\-Age\fP header.
.sp
Default : None

.IP \(bu 2
\fBsend_wildcard\fP (\fIbool\fP) \-\- 
.sp
If True, and the origins parameter is \fI*\fP, a wildcard
\fIAccess\-Control\-Allow\-Origin\fP header is sent, rather than the
request\(aqs \fIOrigin\fP header.
.sp
Default : False

.IP \(bu 2
\fBvary_header\fP (\fIbool\fP) \-\- 
.sp
If True, the header Vary: Origin will be returned as per the W3
implementation guidelines.
.sp
Setting this header when the \fIAccess\-Control\-Allow\-Origin\fP is
dynamically generated (e.g. when there is more than one allowed
origin, and an Origin than \(aq*\(aq is returned) informs CDNs and other
caches that the CORS headers are dynamic, and cannot be cached.
.sp
If False, the Vary header will never be injected or altered.
.sp
Default : True

.IP \(bu 2
\fBautomatic_options\fP (\fIbool\fP) \-\- 
.sp
Only applies to the \fIcross_origin\fP decorator. If True, Flask\-CORS will
override Flask\(aqs default OPTIONS handling to return CORS headers for
OPTIONS requests.
.sp
Default : True

.UNINDENT
.UNINDENT
.UNINDENT
.SS Using \fICORS\fP with cookies
.sp
By default, Flask\-CORS does not allow cookies to be submitted across sites,
since it has potential security implications. If you wish to enable cross\-site
cookies, you may wish to add some sort of
\fI\%CSRF\fP
protection to keep you and your users safe.
.sp
To allow cookies or authenticated requests to be made
cross origins, simply set the \fIsupports_credentials\fP option to \fITrue\fP\&. E.G.
.INDENT 0.0
.INDENT 3.5
.sp
.nf
.ft C
from flask import Flask, session
from flask_cors import CORS

app = Flask(__name__)
CORS(app, supports_credentials=True)

@app.route("/")
def helloWorld():
  return "Hello, %s" % session[\(aqusername\(aq]
.ft P
.fi
.UNINDENT
.UNINDENT
.SS Using \fICORS\fP with Blueprints
.sp
Flask\-CORS supports blueprints out of the box. Simply pass a \fIblueprint\fP
instance to the CORS extension, and everything will just work.
.INDENT 0.0
.INDENT 3.5
.sp
.nf
.ft C
api_v1 = Blueprint(\(aqAPI_v1\(aq, __name__)

CORS(api_v1) # enable CORS on the API_v1 blue print

@api_v1.route("/api/v1/users/")
def list_users():
    \(aq\(aq\(aq
        Since the path matches the regular expression r\(aq/api/*\(aq, this resource
        automatically has CORS headers set. The expected result is as follows:

        $ curl \-\-include \-X GET http://127.0.0.1:5000/api/v1/users/ \e
            \-\-header Origin:www.examplesite.com
        HTTP/1.0 200 OK
        Access\-Control\-Allow\-Headers: Content\-Type
        Access\-Control\-Allow\-Origin: *
        Content\-Length: 21
        Content\-Type: application/json
        Date: Sat, 09 Aug 2014 00:26:41 GMT
        Server: Werkzeug/0.9.4 Python/2.7.8

        {
            "success": true
        }

    \(aq\(aq\(aq
    return jsonify(user="joe")


@api_v1.route("/api/v1/users/create", methods=[\(aqPOST\(aq])
def create_user():
    \(aq\(aq\(aq
        Since the path matches the regular expression r\(aq/api/*\(aq, this resource
        automatically has CORS headers set.

        Browsers will first make a preflight request to verify that the resource
        allows cross\-origin POSTs with a JSON Content\-Type, which can be simulated
        as:
        $ curl \-\-include \-X OPTIONS http://127.0.0.1:5000/api/v1/users/create \e
            \-\-header Access\-Control\-Request\-Method:POST \e
            \-\-header Access\-Control\-Request\-Headers:Content\-Type \e
            \-\-header Origin:www.examplesite.com
        >> HTTP/1.0 200 OK
        Content\-Type: text/html; charset=utf\-8
        Allow: POST, OPTIONS
        Access\-Control\-Allow\-Origin: *
        Access\-Control\-Allow\-Headers: Content\-Type
        Access\-Control\-Allow\-Methods: DELETE, GET, HEAD, OPTIONS, PATCH, POST, PUT
        Content\-Length: 0
        Server: Werkzeug/0.9.6 Python/2.7.9
        Date: Sat, 31 Jan 2015 22:25:22 GMT


        $ curl \-\-include \-X POST http://127.0.0.1:5000/api/v1/users/create \e
            \-\-header Content\-Type:application/json \e
            \-\-header Origin:www.examplesite.com


        >> HTTP/1.0 200 OK
        Content\-Type: application/json
        Content\-Length: 21
        Access\-Control\-Allow\-Origin: *
        Server: Werkzeug/0.9.6 Python/2.7.9
        Date: Sat, 31 Jan 2015 22:25:04 GMT

        {
          "success": true
        }

    \(aq\(aq\(aq
    return jsonify(success=True)

public_routes = Blueprint(\(aqpublic\(aq, __name__)

@public_routes.route("/")
def helloWorld():
    \(aq\(aq\(aq
        Since the path \(aq/\(aq does not match the regular expression r\(aq/api/*\(aq,
        this route does not have CORS headers set.
    \(aq\(aq\(aq
    return \(aq\(aq\(aq<h1>Hello CORS!</h1> Read about my spec at the
<a href="http://www.w3.org/TR/cors/">W3</a> Or, checkout my documentation
on <a href="https://github.com/corydolphin/flask\-cors">Github</a>\(aq\(aq\(aq


logging.basicConfig(level=logging.INFO)
app = Flask(\(aqFlaskCorsBlueprintBasedExample\(aq)
app.register_blueprint(api_v1)
app.register_blueprint(public_routes)


if __name__ == "__main__":
    app.run(debug=True)

.ft P
.fi
.UNINDENT
.UNINDENT
.SS Examples
.SS Using the \fICORS\fP extension
.INDENT 0.0
.INDENT 3.5
.sp
.nf
.ft C
# One of the simplest configurations. Exposes all resources matching /api/* to
# CORS and allows the Content\-Type header, which is necessary to POST JSON
# cross origin.
CORS(app, resources=r\(aq/api/*\(aq)


@app.route("/")
def helloWorld():
    """
        Since the path \(aq/\(aq does not match the regular expression r\(aq/api/*\(aq,
        this route does not have CORS headers set.
    """
    return \(aq\(aq\(aq
<html>
    <h1>Hello CORS!</h1>
    <h3> End to end editable example with jquery! </h3>
    <a class="jsbin\-embed" href="http://jsbin.com/zazitas/embed?js,console">JS Bin on jsbin.com</a>
    <script src="//static.jsbin.com/js/embed.min.js?3.35.12"></script>

</html>
\(aq\(aq\(aq

@app.route("/api/v1/users/")
def list_users():
    """
        Since the path matches the regular expression r\(aq/api/*\(aq, this resource
        automatically has CORS headers set. The expected result is as follows:

        $ curl \-\-include \-X GET http://127.0.0.1:5000/api/v1/users/ \e
            \-\-header Origin:www.examplesite.com
        HTTP/1.0 200 OK
        Access\-Control\-Allow\-Headers: Content\-Type
        Access\-Control\-Allow\-Origin: *
        Content\-Length: 21
        Content\-Type: application/json
        Date: Sat, 09 Aug 2014 00:26:41 GMT
        Server: Werkzeug/0.9.4 Python/2.7.8

        {
            "success": true
        }

    """
    return jsonify(user="joe")


@app.route("/api/v1/users/create", methods=[\(aqPOST\(aq])
def create_user():
    """
        Since the path matches the regular expression r\(aq/api/*\(aq, this resource
        automatically has CORS headers set.

        Browsers will first make a preflight request to verify that the resource
        allows cross\-origin POSTs with a JSON Content\-Type, which can be simulated
        as:
        $ curl \-\-include \-X OPTIONS http://127.0.0.1:5000/api/v1/users/create \e
            \-\-header Access\-Control\-Request\-Method:POST \e
            \-\-header Access\-Control\-Request\-Headers:Content\-Type \e
            \-\-header Origin:www.examplesite.com
        >> HTTP/1.0 200 OK
        Content\-Type: text/html; charset=utf\-8
        Allow: POST, OPTIONS
        Access\-Control\-Allow\-Origin: *
        Access\-Control\-Allow\-Headers: Content\-Type
        Access\-Control\-Allow\-Methods: DELETE, GET, HEAD, OPTIONS, PATCH, POST, PUT
        Content\-Length: 0
        Server: Werkzeug/0.9.6 Python/2.7.9
        Date: Sat, 31 Jan 2015 22:25:22 GMT


        $ curl \-\-include \-X POST http://127.0.0.1:5000/api/v1/users/create \e
            \-\-header Content\-Type:application/json \e
            \-\-header Origin:www.examplesite.com


        >> HTTP/1.0 200 OK
        Content\-Type: application/json
        Content\-Length: 21
        Access\-Control\-Allow\-Origin: *
        Server: Werkzeug/0.9.6 Python/2.7.9
        Date: Sat, 31 Jan 2015 22:25:04 GMT

        {
          "success": true
        }

    """
    return jsonify(success=True)

@app.route("/api/exception")
def get_exception():
    """
        Since the path matches the regular expression r\(aq/api/*\(aq, this resource
        automatically has CORS headers set.

        Browsers will first make a preflight request to verify that the resource
        allows cross\-origin POSTs with a JSON Content\-Type, which can be simulated
        as:
        $ curl \-\-include \-X OPTIONS http://127.0.0.1:5000/exception \e
            \-\-header Access\-Control\-Request\-Method:POST \e
            \-\-header Access\-Control\-Request\-Headers:Content\-Type \e
            \-\-header Origin:www.examplesite.com
        >> HTTP/1.0 200 OK
        Content\-Type: text/html; charset=utf\-8
        Allow: POST, OPTIONS
        Access\-Control\-Allow\-Origin: *
        Access\-Control\-Allow\-Headers: Content\-Type
        Access\-Control\-Allow\-Methods: DELETE, GET, HEAD, OPTIONS, PATCH, POST, PUT
        Content\-Length: 0
        Server: Werkzeug/0.9.6 Python/2.7.9
        Date: Sat, 31 Jan 2015 22:25:22 GMT
    """
    raise Exception("example")

@app.errorhandler(500)
def server_error(e):
    logging.exception(\(aqAn error occurred during a request. %s\(aq, e)
    return "An internal error occured", 500


if __name__ == "__main__":
    app.run(debug=True)

.ft P
.fi
.UNINDENT
.UNINDENT
.SS Using the \fIcross_origins\fP decorator
.INDENT 0.0
.INDENT 3.5
.sp
.nf
.ft C
@app.route("/", methods=[\(aqGET\(aq])
@cross_origin()
def helloWorld():
    \(aq\(aq\(aq
        This view has CORS enabled for all domains, representing the simplest
        configuration of view\-based decoration. The expected result is as
        follows:

        $ curl \-\-include \-X GET http://127.0.0.1:5000/ \e
            \-\-header Origin:www.examplesite.com

        >> HTTP/1.0 200 OK
        Content\-Type: text/html; charset=utf\-8
        Content\-Length: 184
        Access\-Control\-Allow\-Origin: *
        Server: Werkzeug/0.9.6 Python/2.7.9
        Date: Sat, 31 Jan 2015 22:29:56 GMT

        <h1>Hello CORS!</h1> Read about my spec at the
        <a href="http://www.w3.org/TR/cors/">W3</a> Or, checkout my documentation
        on <a href="https://github.com/corydolphin/flask\-cors">Github</a>

    \(aq\(aq\(aq
    return \(aq\(aq\(aq<h1>Hello CORS!</h1> Read about my spec at the
<a href="http://www.w3.org/TR/cors/">W3</a> Or, checkout my documentation
on <a href="https://github.com/corydolphin/flask\-cors">Github</a>\(aq\(aq\(aq


@app.route("/api/v1/users/create", methods=[\(aqGET\(aq, \(aqPOST\(aq])
@cross_origin(allow_headers=[\(aqContent\-Type\(aq])
def cross_origin_json_post():
    \(aq\(aq\(aq
        This view has CORS enabled for all domains, and allows browsers
        to send the Content\-Type header, allowing cross domain AJAX POST
        requests.

 Browsers will first make a preflight request to verify that the resource
        allows cross\-origin POSTs with a JSON Content\-Type, which can be simulated
        as:
        $ curl \-\-include \-X OPTIONS http://127.0.0.1:5000/api/v1/users/create \e
            \-\-header Access\-Control\-Request\-Method:POST \e
            \-\-header Access\-Control\-Request\-Headers:Content\-Type \e
            \-\-header Origin:www.examplesite.com
        >> HTTP/1.0 200 OK
        Content\-Type: text/html; charset=utf\-8
        Allow: POST, OPTIONS
        Access\-Control\-Allow\-Origin: *
        Access\-Control\-Allow\-Headers: Content\-Type
        Access\-Control\-Allow\-Methods: DELETE, GET, HEAD, OPTIONS, PATCH, POST, PUT
        Content\-Length: 0
        Server: Werkzeug/0.9.6 Python/2.7.9
        Date: Sat, 31 Jan 2015 22:25:22 GMT


        $ curl \-\-include \-X POST http://127.0.0.1:5000/api/v1/users/create \e
            \-\-header Content\-Type:application/json \e
            \-\-header Origin:www.examplesite.com


        >> HTTP/1.0 200 OK
        Content\-Type: application/json
        Content\-Length: 21
        Access\-Control\-Allow\-Origin: *
        Server: Werkzeug/0.9.6 Python/2.7.9
        Date: Sat, 31 Jan 2015 22:25:04 GMT

        {
          "success": true
        }

    \(aq\(aq\(aq

    return jsonify(success=True)

if __name__ == "__main__":
    app.run(debug=True)

.ft P
.fi
.UNINDENT
.UNINDENT
.SH AUTHOR
Cory Dolphin
.SH COPYRIGHT
2020, Cory Dolphin
.\" Generated by docutils manpage writer.
.