How to enable CORS in Hunchentoot or Clack, or how to add a specific header?

The question says it all. This tutorial: https://www.html5rocks.com/en/tutorials/cors/ says to, at the very least, add a Access-Control-Allow-Origin: * header to the server's response.

My app, running Hunchentoot, doesn't return it:

<!-- GET http://127.0.0.1:9000/ -->
<!-- HTTP/1.1 200 OK -->
<!-- Date: Fri, 13 Oct 2017 23:26:58 GMT -->
<!-- Server: Hunchentoot 1.2.37 -->
<!-- Keep-Alive: timeout=20 -->
<!-- Connection: Keep-Alive -->
<!-- Transfer-Encoding: chunked -->
<!-- Content-Type: text/html;charset=utf-8 -->
<!-- Request duration: 0.004275s -->

I looked at Hunchentoot's doc and its headers.lisp file but couldn't find anything CORS-specific and didn't understand how to simply add a header.

Any help ? Thanks !

---

edit: I'm actually using Lucerne and Clack.

(in-package :cl-user)
(defpackage lisp-todo
  (:use :cl
        :lucerne)
  (:export :app)
  (:documentation "Main lisp-todo code."))
(in-package :lisp-todo)

adding

(defun change-headers (headers)
  (setf (lack.response:response-headers *response*) headers))

C-c C-c =>

package lack.response does not exist.

or with Hunchentoot:

(setf (hunchentoot:header-out "Access-Control-Allow-Origin") "*")

the variable Hunchentoot:*reply* is unbound.

indeed this variable is defined with def-unbound.

---

edit2: trying with Ningle

(in-package :cl-user)
(defpackage todobackend-ningle
  (:use :cl))
(in-package :todobackend-ningle)

;; blah blah blah.

(defvar *response* nil "") ;; to try the snippet below

(defun change-headers (headers)
  ;; (setf (lack.response:response-headers *response*) headers)) ;; => the value nil is not of type lack.response:response
  (setf (lack.response:response-headers lack.response:response) headers)) ;; => unbound

(defvar *app* (make-instance 'ningle:<app>))

(change-headers '(:access-control-allow-origin "*"))

(setf (ningle:route *app* "/")
      (lambda (params) ;; is that right ?
           (change-headers '(:access-control-allow-origin "*"))
           "Welcome to ningle!"))

Here is the code I use for Clack with Ningle, hopefully it can help you:

(defpackage ...
  (:use :cl :ningle))
(in-package ...)

(defun change-headers (headers)
  (setf (lack.response:response-headers *response*) headers))

(defmacro api-route (url method en-tetes &body corps)
  `(setf (ningle:route *app* ,url :method ,method)
     ;; that's why your code doesn't work, you actually have to pass a #'function
     #'(lambda (params)
         (change-headers ,headers)
         ,@corps)))

Note : *response* comes from ningle.context, and I'm probably using it wrong, according to the comments in the file.

This macro can be used to create a route and specify headers, like this:

(api-route
   "/"
   :get
   '(:access-control-allow-origin "*")
   "Welcome!")

Remember, this is enough for a GET request, but for other verbs the browser will first hit OPTIONS. You'll have to answer it with at least those headers:

  '(:access-control-allow-methods "POST"          ; or any other verb(s)
    :access-control-allow-origin "*"
    :access-control-allow-headers "content-type")

_{This code comes from a small toy project of mine. You can look at the rest of it if you want, hopefully it can give you ideas. It’s nothing grand, and there probably are better ways to do it, but hey — it works.}