flask-cors

library6.0.2pypypi✓ verified 52d ago

Flask-CORS is a Flask extension that simplifies the implementation of Cross-Origin Resource Sharing (CORS) in Flask applications, enabling cross-origin AJAX requests. It supports global, resource-specific, and route-specific CORS configurations. The current version is 6.0.2, and it maintains an active release cadence with regular updates and security patches.

web-framework auth-security

pip install Flask-CORS

github ↗package ↗homepage ↗docs ↗

Install & Compatibility

Where this runs

tested against v6.0.5 · pip install

no network on importno background threads

Install × environment matrix

Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux

musl

py 3.10–3.925 runs

installs and imports cleanly · install 0.0s · import 0.518s · 22.8MB

glibc

py 3.10–3.925 runs

installs and imports cleanly · install 2.3s · import 0.473s · 23MB

21MB installed

● package 21MB

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

CORS

✓ from flask_cors import CORS

✗ from flask.ext.cors import CORS

The `flask.ext` prefix was deprecated and removed in Flask 0.11. Direct import from `flask_cors` is the correct approach.

cross_origin

✓ from flask_cors import cross_origin

This quickstart demonstrates enabling CORS globally for an entire Flask application and also for a specific route using the `@cross_origin` decorator. Global enablement is done by initializing `CORS(app)`. For fine-grained control, the `@cross_origin` decorator allows specifying allowed origins, methods, and credential support for individual routes.

from flask import Flask from flask_cors import CORS import os app = Flask(__name__) CORS(app) # Enable CORS for all routes, for all origins and methods @app.route("/") def hello_world(): return "Hello, cross-origin-world!" # Example of specific CORS for an API endpoint @app.route("/api/data") @cross_origin(origins="http://localhost:3000", methods=["GET", "POST"], supports_credentials=True) def get_data(): return {"message": "Data from API!"} if __name__ == '__main__': app.run(debug=True, port=int(os.environ.get('PORT', 5000)))

Debug

Known issues

breakingIn version 6.0.0, the path specificity ordering for CORS rules changed to improve specificity. This might alter how CORS rules are applied if your application relied on the previous, less specific ordering. Additionally, `urllib.unquote_plus` was replaced with `urllib.unquote`, and request path matching became case-sensitive.

fix

Review your CORS configurations, especially those with multiple resource paths, to ensure they match the new specificity order. Test cross-origin requests thoroughly to confirm expected behavior. Ensure your application's request paths are consistently cased if matching rules rely on it.

affects: 6.0.0 and higher

breakingVersion 5.0.0 introduced a breaking change by defaulting to disable private network access. This was a security enhancement. If your application needs to make requests to private network resources from a public-facing origin, you will need to explicitly re-enable this functionality.

fix

If your application requires private network access, consult the Flask-CORS documentation for the specific configuration option to re-enable it. Typically, this involves setting a configuration flag.

affects: 5.0.0 and higher

breakingVersion 4.0.0 dropped support for Python versions older than 3.8. Applications running on Python 3.7 or earlier will not be able to upgrade to Flask-CORS 4.0.0 or newer.

fix

Upgrade your Python environment to 3.8 or newer before upgrading to Flask-CORS 4.0.0+.

affects: 4.0.0 and higher

gotchaEnabling `supports_credentials=True` allows browsers to send cookies and HTTP authentication headers with cross-origin requests. While necessary for authenticated requests, it introduces security implications and should always be used in conjunction with robust CSRF protection.

fix

Implement CSRF protection (e.g., Flask-WTF CSRFProtect) when `supports_credentials=True` is enabled. Carefully define `origins` to restrict access to trusted domains only.

affects: All versions

gotchaUsing `origins='*'` (allowing all origins) is generally not recommended for production environments due to security risks. It can expose your API to unintended access.

fix

Always specify a list of explicit, trusted `origins` (e.g., `origins=['http://localhost:3000', 'https://your-frontend.com']`) instead of `*` in production deployments.

affects: All versions

gotchaWhen specifying `origins` in `CORS` or `@cross_origin`, ensure you include the full schema (http/https) and the port number (if not the default 80 or 443). For example, `http://localhost:8000` is correct, while `localhost:8000` or `http://localhost` (if on a non-default port) might not work.

fix

Always provide complete origin URLs, including schema and port, in the `origins` list or string.

affects: All versions

gotchaThe `cross_origin` decorator/function must be explicitly imported from `flask_cors` before use, otherwise a `NameError` will occur.

fix

Ensure `cross_origin` is imported from `flask_cors` (e.g., `from flask_cors import cross_origin`).

affects: All versions

gotchaThe `cross_origin` decorator must be explicitly imported from `flask_cors` before use. Failing to import it (e.g., `from flask_cors import cross_origin`) will result in a `NameError`.

fix

Ensure that `from flask_cors import cross_origin` is included at the top of any file where the `@cross_origin` decorator is used.

affects: All versions

Errors

Common errors & fixes

ModuleNotFoundError: No module named 'flask_cors'

The 'flask-cors' package has not been installed in your Python environment or is not accessible in the environment where your Flask application is running.

fix

Install the package using pip: `pip install flask-cors`

Access to fetch at 'http://your-flask-app.com/api' from origin 'http://your-frontend.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.

Your Flask server is not configured to send the 'Access-Control-Allow-Origin' header, which is required by browsers to allow cross-origin requests from your frontend application. This often happens because Flask-CORS is not initialized or configured correctly to allow the specific origin of the client application.

fix

Initialize Flask-CORS on your Flask app, specifying the allowed origins. For all origins (development): `from flask_cors import CORS; CORS(app)`. For specific origins: `CORS(app, origins=['http://your-frontend.com'])`

Method Not Allowed (405)

This error, in the context of CORS, often occurs during a preflight OPTIONS request or for complex requests (e.g., PUT, DELETE with custom headers) where the Flask-CORS configuration does not explicitly allow the HTTP method being used or the necessary headers for the preflight response.

fix

Ensure `flask-cors` is configured to allow the specific HTTP methods and headers for your routes. When initializing `CORS(app)`, you can specify `methods=['GET', 'POST', 'PUT', 'DELETE', 'OPTIONS']` and `headers=['Content-Type', 'Authorization']` (adjust as needed). Also, ensure `OPTIONS` requests are handled, which Flask-CORS does by default when enabled globally or per route with `@cross_origin()`.

Access to XMLHttpRequest at 'http://your-flask-app.com/data' from origin 'http://localhost:3000' has been blocked by CORS policy: The value of the 'Access-Control-Allow-Origin' header in the response must not be the wildcard '*' when the request's credentials mode is 'include'.

You are attempting to make a cross-origin request with credentials (e.g., cookies, HTTP authentication) while the server's 'Access-Control-Allow-Origin' header is set to '*', which is not permitted by the W3C CORS specification for security reasons.

fix

When using `supports_credentials=True` in `CORS(app, supports_credentials=True)`, you must specify exact origins instead of the wildcard '*'. Change `CORS(app)` or `CORS(app, origins='*')` to `CORS(app, origins=['http://localhost:3000'], supports_credentials=True)` (replace 'http://localhost:3000' with your actual frontend origin).

Upgrade

Version history

6.0.5latest on PyPI

Audit

Dependencies

FlaskrequiredCore dependency for a Flask extension.

PythonrequiredRequires Python versions >=3.9,<4.0.

Agent activity

53 hits · last 30 days

node

seranking-bot

ahrefsbot