Corser is a highly configurable middleware for Node.js designed to handle Cross-Origin Resource Sharing (CORS). It offers a flexible approach to managing CORS preflight requests and setting appropriate response headers, supporting both static whitelists for allowed origins and dynamic origin checking through a callback function. The package's current stable version is 2.0.1, released in August 2016. Due to the lack of updates since then, its release cadence is effectively non-existent, indicating an abandoned or legacy status despite an 'active' project badge from its active development period. Its key differentiators at the time included robust compatibility with Connect and Express middleware, as well as plain Node.js `http` servers, providing granular control over CORS policies for various server setups. Developers should be aware of its CommonJS-only nature and lack of ongoing maintenance.
npm install corserVerified import paths — ran on the pinned version, not inferred.
This example demonstrates how to integrate Corser as middleware within an Express.js application, allowing all cross-origin requests by default.
If you need to handle `OPTIONS` requests manually, configure Corser with `corser.create({ endPreflightRequests: false })` and implement your own handler.Update your dynamic origin callback function to accept an error parameter: `function(origin, callback) { callback(null, matches); }`.Always use `const corser = require('corser');` for importing. If in an ESM project, consider using a different, actively maintained CORS middleware that supports ESM.Evaluate newer, actively maintained CORS middleware solutions like the 'cors' package (npmjs.com/package/cors) for modern applications.
Use the correct CommonJS `require` syntax: `const corser = require('corser');` then `corser.create()`.Either convert your project to CommonJS (remove 'type: module' from package.json) or use a different CORS middleware that supports ES Modules. You could also explore `createRequire` for advanced interoperability, but it's generally not recommended for simple imports.
Ensure the `origins` array explicitly includes the client's origin (e.g., `['http://localhost:3000']`) or that your dynamic origin function correctly returns `true` for the callback. Check for typos in the origin URL. Also ensure Corser middleware is applied correctly and not skipped.
Review your middleware setup to ensure `app.use(corser.create())` or similar is called only once per request or once during app initialization. This often happens if it's included in a generic router that's also mounted globally.