# `ExMCP.Security.CORS`
[🔗](https://github.com/azmaveth/ex_mcp/blob/v1.0.0/lib/ex_mcp/security/cors.ex#L1)

Handles Cross-Origin Resource Sharing (CORS) logic.

This module is responsible for validating request origins and building
appropriate CORS headers for responses.

# `auth_method`

```elixir
@type auth_method() ::
  {:bearer, token :: String.t()}
  | {:api_key, key :: String.t(), opts :: keyword()}
  | {:basic, username :: String.t(), password :: String.t()}
  | {:custom, headers :: [{String.t(), String.t()}]}
  | {:oauth2, map()}
```

# `cors_config`

```elixir
@type cors_config() :: %{
  optional(:allowed_origins) => [String.t()] | :any,
  optional(:allowed_methods) => [String.t()],
  optional(:allowed_headers) => [String.t()],
  optional(:expose_headers) => [String.t()],
  optional(:max_age) => integer(),
  optional(:allow_credentials) => boolean()
}
```

# `security_config`

```elixir
@type security_config() :: %{
  optional(:auth) => auth_method(),
  optional(:headers) => [{String.t(), String.t()}],
  optional(:validate_origin) => boolean(),
  optional(:allowed_origins) => [String.t()],
  optional(:cors) => cors_config(),
  optional(:tls) => tls_config()
}
```

# `tls_config`

```elixir
@type tls_config() :: %{
  optional(:verify) => :verify_peer | :verify_none,
  optional(:cacerts) => [binary()],
  optional(:cert) => binary(),
  optional(:key) => binary(),
  optional(:versions) => [atom()],
  optional(:ciphers) => [String.t()]
}
```

# `build_cors_headers`

```elixir
@spec build_cors_headers(cors_config(), String.t() | nil) :: [
  {String.t(), String.t()}
]
```

Builds CORS headers based on configuration.

# `validate_origin`

```elixir
@spec validate_origin(String.t() | nil, [String.t()] | :any) ::
  :ok | {:error, :origin_not_allowed}
```

Validates origin header against allowed origins.

## Examples

    iex> ExMCP.Security.CORS.validate_origin("https://example.com", ["https://example.com"])
    :ok

    iex> ExMCP.Security.CORS.validate_origin("https://evil.com", ["https://example.com"])
    {:error, :origin_not_allowed}

# `validate_request_origin`

```elixir
@spec validate_request_origin(String.t() | nil, security_config()) ::
  :ok | {:error, :origin_validation_failed}
```

Validates request origin against security policy.

This implements DNS rebinding attack protection as required by the MCP spec.

---

*Consult [api-reference.md](api-reference.md) for complete listing*