What parameters can we specify along with it's acceptable options in CORSWithConfig using middleware in Echo Framework Golang custom configuration

What are the parameters and their acceptable values, and how to use CORSWithConfig custom configuration in middleware while using echo framework, in golang, to handle CORS.

Actually, there are many other parameters. You can read about them here.

<hr>

Configurations

CORSConfig struct {
  // Skipper defines a function to skip middleware.
  Skipper Skipper

  // AllowOrigin defines a list of origins that may access the resource.
  // Optional. Default value []string{"*"}.
  AllowOrigins []string `yaml:"allow_origins"`

  // AllowOriginFunc is a custom function to validate the origin. It takes the
  // origin as an argument and returns true if allowed or false otherwise. If
  // an error is returned, it is returned by the handler. If this option is
  // set, AllowOrigins is ignored.
  // Optional.
  AllowOriginFunc func(origin string) (bool, error) `yaml:"allow_origin_func"`

  // AllowMethods defines a list methods allowed when accessing the resource.
  // This is used in response to a preflight request.
  // Optional. Default value DefaultCORSConfig.AllowMethods.
  AllowMethods []string `yaml:"allow_methods"`

  // AllowHeaders defines a list of request headers that can be used when
  // making the actual request. This is in response to a preflight request.
  // Optional. Default value []string{}.
  AllowHeaders []string `yaml:"allow_headers"`

  // AllowCredentials indicates whether or not the response to the request
  // can be exposed when the credentials flag is true. When used as part of
  // a response to a preflight request, this indicates whether or not the
  // actual request can be made using credentials.
  // Optional. Default value false.
  AllowCredentials bool `yaml:"allow_credentials"`

  // ExposeHeaders defines a whitelist headers that clients are allowed to
  // access.
  // Optional. Default value []string{}.
  ExposeHeaders []string `yaml:"expose_headers"`

  // MaxAge indicates how long (in seconds) the results of a preflight request
  // can be cached.
  // Optional. Default value 0.
  MaxAge int `yaml:"max_age"`
}

<hr>

Example Usage

e := echo.New()
e.Use(middleware.CORSWithConfig(middleware.CORSConfig{
  AllowOrigins: []string{"https://labstack.com", "https://labstack.net"},
  AllowHeaders: []string{echo.HeaderOrigin, echo.HeaderContentType, 
echo.HeaderAccept},
}))

<hr>

Default

DefaultCORSConfig = CORSConfig{
  Skipper:      DefaultSkipper,
  AllowOrigins: []string{"*"},
  AllowMethods: []string{http.MethodGet, http.MethodHead, http.MethodPut, http.MethodPatch, http.MethodPost, http.MethodDelete},
}

Here's a sample on how we can use CORSWithConfig
and all the possible values we can use with AllowHeaders, ExposeHeaders, and AllowMethods.

app := echo.New()
app.Use(middleware.CORSWithConfig(middleware.CORSConfig{
AllowOrigins: []string{"http://127.0.0.1:5173", "wails://wails.localhost:34115", "http://127.0.0.1:5174"},
// AllowOrigins:     []string{"*"},
AllowHeaders:     []string{echo.HeaderOrigin, echo.HeaderContentType, echo.HeaderAccept, echo.HeaderAccessControlAllowOrigin, echo.HeaderAccessControlAllowCredentials, echo.HeaderAccessControlAllowHeaders, echo.HeaderAccessControlAllowMethods, echo.HeaderAccessControlExposeHeaders, echo.HeaderAccessControlMaxAge, echo.HeaderAccessControlRequestHeaders, echo.HeaderAccessControlRequestMethod, echo.HeaderAuthorization, echo.HeaderContentLength, echo.HeaderContentSecurityPolicy, echo.HeaderContentType, echo.HeaderCookie, echo.HeaderLastModified, echo.HeaderLocation, echo.HeaderOrigin, echo.HeaderServer, echo.HeaderSetCookie, echo.HeaderStrictTransportSecurity, echo.HeaderUpgrade, echo.HeaderVary, echo.HeaderWWWAuthenticate, echo.HeaderXContentTypeOptions, echo.HeaderXCSRFToken, echo.HeaderXFrameOptions, echo.HeaderXRequestID, echo.HeaderXRequestedWith, echo.HeaderXForwardedFor, echo.HeaderXForwardedProto, echo.HeaderXRealIP, echo.HeaderXCSRFToken},
AllowCredentials: true,
// ExposeHeaders:    []string{"*"},
ExposeHeaders: []string{echo.HeaderOrigin, echo.HeaderContentType, echo.HeaderAccept, echo.HeaderAccessControlAllowOrigin, echo.HeaderAccessControlAllowCredentials, echo.HeaderAccessControlAllowHeaders, echo.HeaderAccessControlAllowMethods, echo.HeaderAccessControlExposeHeaders, echo.HeaderAccessControlMaxAge, echo.HeaderAccessControlRequestHeaders, echo.HeaderAccessControlRequestMethod, echo.HeaderAuthorization, echo.HeaderContentLength, echo.HeaderContentSecurityPolicy, echo.HeaderContentType, echo.HeaderCookie, echo.HeaderLastModified, echo.HeaderLocation, echo.HeaderOrigin, echo.HeaderServer, echo.HeaderSetCookie, echo.HeaderStrictTransportSecurity, echo.HeaderUpgrade, echo.HeaderVary, echo.HeaderWWWAuthenticate, echo.HeaderXContentTypeOptions, echo.HeaderXCSRFToken, echo.HeaderXFrameOptions, echo.HeaderXRequestID, echo.HeaderXRequestedWith, echo.HeaderXForwardedFor, echo.HeaderXForwardedProto, echo.HeaderXRealIP, echo.HeaderXCSRFToken, "X-User-Id", "X-User-Email", "X-User-Name", "X-User-Role", "X-User-Permissions", "X-User-Groups", "X-User-Scopes", "X-User-Sub", "X-Set-Cookie", "X-Set-Cookie-Expires", "X-Set-Cookie-Max-Age", "X-Set-Cookie-Path", "X-Set-Cookie-Domain", "X-Set-Cookie-Secure", "X-Set-Cookie-HttpOnly", "X-Set-Cookie-SameSite", "X-Set-Cookie-Raw"},
AllowMethods:  []string{echo.GET, echo.HEAD, echo.PUT, echo.PATCH, echo.POST, echo.DELETE},
}))