Registry / web-framework / cors

cors

JSON →
library1.0.1jsnpmunverified

CORS is a Node.js middleware for Express and Connect that simplifies setting Cross-Origin Resource Sharing (CORS) response headers. It helps browsers determine which origins can read responses from your server. The current stable version is 2.8.6. Releases are made periodically to address maintenance and update documentation.

web-framework
npm install cors
github ↗package ↗
INSTALL
IMPORT
SIG · CORS
C
cors
web-frameworkjavascriptv1.0.1
Install
—
Import
—
Disk
—
Pass rate
0/ 6
Env Coverage0 / 6
glibc
18–22
musl
18–22
Install & Compatibility
Where this runs
tested against v? · npm install
Install × environment matrix
Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux
musl
node 18–226 runs
build_error
glibc
node 18–226 runs
build_error
Code
Verified usage

Verified import paths — ran on the pinned version, not inferred.

cors
✓ const cors = require('cors')
✗ import cors from 'cors'
This package primarily uses CommonJS `require()` syntax.

This example shows how to enable CORS for all routes in an Express application, adding the `Access-Control-Allow-Origin: *` header to all responses.

var express = require('express'); var cors = require('cors'); var app = express(); // Enable all CORS requests for all routes app.use(cors()); app.get('/products/:id', function (req, res, next) { res.json({msg: 'Hello'}); }); app.listen(80, function () { console.log('web server listening on port 80'); });
Debug
Known issues
gotchaThis package only sets CORS response headers; it does not block requests. CORS enforcement is solely handled by web browsers. Non-browser clients (e.g., cURL, Postman, server-to-server requests) completely ignore CORS headers.
fix
Understand that CORS is a browser security mechanism. Server-side validation of origins or API keys is necessary for non-browser clients or for blocking unwanted requests.
affects: >=2.0.0
gotchaSome legacy browsers (like IE11 or various SmartTVs) may choke on a 204 status code for successful OPTIONS pre-flight requests.
fix
When configuring CORS options, set `optionsSuccessStatus: 200` to ensure compatibility with older clients that expect a 200 OK for pre-flight success.
affects: >=2.0.0
gotchaWhen using a dynamic `origin` function to validate origins, return `callback(null, false)` for disallowed origins instead of an error. This correctly signals to the browser to block the request without exposing server-side error details.
fix
Modify your dynamic origin function to explicitly call `callback(null, false)` for any origin that should not be allowed, rather than `callback(new Error(...))`.
affects: >=2.0.0
Errors
Common errors & fixes
Access to XMLHttpRequest at '...' from origin '...' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
The server's response did not include the 'Access-Control-Allow-Origin' header, or it did not match the client's origin.
fix
Ensure the `cors()` middleware is correctly applied to your routes. For specific origins, configure the `origin` option in `cors()` (e.g., `cors({ origin: 'http://your-frontend.com' })`). For development, `app.use(cors())` enables all origins.
Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Headers' header is present on the requested resource.
The server's preflight (OPTIONS) response did not include the necessary 'Access-Control-Allow-Headers' header, often when custom headers are used.
fix
If your client sends custom headers (e.g., `Authorization`), specify them in the `allowedHeaders` option of the `cors()` middleware (e.g., `cors({ allowedHeaders: ['Content-Type', 'Authorization'] })`).
Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at ... (Reason: CORS header 'Access-Control-Allow-Credentials' missing).
The client is sending credentials (e.g., cookies, HTTP authentication), but the server did not include `Access-Control-Allow-Credentials: true` in its response.
fix
Set the `credentials` option to `true` in your `cors()` middleware configuration (e.g., `cors({ origin: 'http://your-frontend.com', credentials: true })`). Also, ensure your client-side fetch/XHR request has `credentials: 'include'`.
Upgrade
Version history
1.0.1latest on npm
Audit
Dependencies

No dependency data recorded yet.

Agent activity
4 hits · last 30 days
node
4
Resources
githubhttps://github.com/expressjs/cors ↗
packagehttps://www.npmjs.com/package/cors ↗