idootop/tauri-plugin-cors-fetch

An unofficial Tauri plugin that enables seamless cross-origin (CORS) requests by transparently proxying the native fetch API through Tauri's HTTP client.

• Zero Code Change: Use standard fetch() as you normally would.
• Streaming & SSE: Full support for Response Streaming and Server-Sent Events (SSE).
• Configurable: Granular control over which domains bypass CORS.
• Multi-platform: Supports Windows, macOS, Linux, iOS, and Android.

1. Install Dependencies

Add the plugin to your Cargo.toml:

# src-tauri
cargo add tauri-plugin-cors-fetch

2. Initialize Plugin

Register the plugin in your Tauri setup:

// src-tauri/src/lib.rs
pub fn run() {
    tauri::Builder::default()
        .plugin(tauri_plugin_cors_fetch::init()) // 👈 here
        .run(tauri::generate_context!())
        .expect("failed to run app");
}

3. Configure Permissions & Settings

Add the required permission to your capability file:

// src-tauri/capabilities/default.json
{
  "permissions": ["cors-fetch:default"]
}

Ensure withGlobalTauri is enabled in tauri.conf.json:

// src-tauri/tauri.conf.json
{
  "app": {
    "withGlobalTauri": true
  }
}

Once initialized, the plugin automatically hooks into the global fetch. No changes to your frontend code are required:

// This request now bypasses CORS automatically
const response = await fetch("https://api.openai.com");
const data = await response.json();

You can fine-tune the behavior via window.CORSFetch.config():

window.CORSFetch.config({
  include: [/^https?:\/\//i], // Patterns to proxy (default: all)
  exclude: ["https://api.openai.com/v1/chat/completions"],
  // Default request options for Tauri HTTP Client
  request: {
    connectTimeout: 30 * 1000, // ms
    maxRedirections: 5,
    proxy: {
      all: "http://127.0.0.1:7890",
    },
    danger: {
      acceptInvalidCerts: false,
      acceptInvalidHostnames: false,
    },
    userAgent: navigator.userAgent,
  },
});

• window.fetchCORS(url, init): Explicitly use the CORS-bypassing fetch.
• window.fetchNative(url, init): Use the original browser fetch (subject to CORS).

• Fetch Only: Does not support XMLHttpRequest (XHR).

MIT License © 2024-PRESENT Del Wang