Install & Compatibility
Where this runs
tested against v0.8.0 · pip install
no network on importno background threads
Install × environment matrix
Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux
muslpy 3.10–3.95 runs
installs and imports cleanly · install 0.0s · import 1.540s · 26.5MB
glibcpy 3.10–3.95 runs
installs and imports cleanly · install 2.9s · import 1.510s · 27MB
25MB installed
● package 25MB
Code
Verified usage
Verified import paths — ran on the pinned version, not inferred.
cors
✓ from quart_cors import cors
Used to apply CORS settings application-wide or to a blueprint.
route_cors
✓ from quart_cors import route_cors
Decorator for applying CORS settings to individual HTTP routes.
websocket_cors
✓ from quart_cors import websocket_cors
Decorator for applying CORS settings to individual WebSocket handlers.
cors_exempt
✓ from quart_cors import cors_exempt
Decorator to exempt a route or WebSocket handler from global CORS settings.
This quickstart demonstrates how to initialize a Quart application and apply CORS globally using `cors(app, allow_origin='*')`. It also shows how to use the `route_cors` decorator to apply more specific CORS rules to an individual API endpoint, allowing GET and POST requests from a specific origin with custom headers. Remember to replace `allow_origin='*'` with specific origins in production for security.
from quart import Quart, request
from quart_cors import cors, route_cors
app = Quart(__name__)
# Apply CORS to the entire application, allowing all origins
# For production, specify allowed origins instead of '*'
app = cors(app, allow_origin='*')
@app.route('/')
async def hello():
return 'Hello, Quart-CORS!'
@app.route('/api/data', methods=['GET', 'POST'])
@route_cors(allow_origin='https://example.com', allow_methods=['GET', 'POST'], allow_headers=['Content-Type'])
async def api_data():
if request.method == 'GET':
return {'message': 'This is your data!'}
elif request.method == 'POST':
data = await request.get_json()
return {'received': data, 'message': 'Data posted successfully!'}
if __name__ == '__main__':
app.run()
Debug
Known issues
breakingWhen `allow_credentials=True`, the `allow_origin` parameter MUST NOT be a wildcard (`*`). Instead, it must be a specific origin or a list of specific origins, as required by the CORS specification for security reasons.fixIf `allow_credentials` is true, explicitly list all allowed origins (e.g., `allow_origin=['https://your-frontend.com']`) instead of using `'*'`.
affects: All versions
gotchaAggressive browser caching (especially in Chrome) can lead to CORS errors persisting even after server-side fixes are deployed. Browsers might cache preflight `OPTIONS` responses, leading to outdated CORS headers being used.fixClear browser cache (especially for the affected domain) or disable cache in browser developer tools (Network tab) when debugging CORS issues. Consider setting appropriate `Access-Control-Max-Age` headers on your server.
affects: All versions
breakingAs of Quart 0.11.1, the CORS specification dictates that only a single origin (or a wildcard) can be returned in the `Access-Control-Allow-Origin` header. If multiple specific origins are allowed by `quart-cors`, the library will dynamically set the header to the requesting origin if it's in the allowed list.fixEnsure your frontend understands this behavior. `quart-cors` handles this dynamically for you if you provide a list of allowed origins, but be aware that the browser will only see one origin in the response header.
affects: >=0.11.1 of Quart (affecting quart-cors's behavior)
breakingAttempting to use `Flask-CORS` with a Quart application will not work, as `Flask-CORS` relies on synchronous `app.make_response` calls which are incompatible with Quart's async nature.fixAlways use `quart-cors` for Quart applications to ensure proper asynchronous handling of CORS headers.
affects: All versions
gotchaWhile `quart-cors` is generally backward compatible with `Quart`, ensure that `quart` and `quart-cors` versions are reasonably aligned. Significant version jumps of `Quart` might introduce subtle incompatibilities.fixRegularly update both `quart` and `quart-cors`. If encountering unexpected behavior after an update, check the changelogs for both libraries for any breaking changes or specific compatibility notes.
affects: All versions, especially with older Quart versions (e.g., Quart < 0.11.1 with newer quart-cors features)
Errors
Common errors & fixes
ModuleNotFoundError: No module named 'quart_cors'
The 'quart-cors' package is not installed in your Python environment or there is a typo in the import statement.
fixInstall the library using `pip install quart-cors`.
AttributeError: module 'quart_cors' has no attribute 'CORS'
You are attempting to access a non-existent `CORS` class; `quart-cors` exposes its main functionality via a lowercase `cors` function, not an uppercase class.
fixImport and use the `cors` function, for example: `from quart_cors import cors` and then `cors(app)`.
from quart_cors import CORS
This import attempts to load a class named `CORS`, but `quart-cors` provides its main functionality through a lowercase `cors` function.
fixCorrect the import statement to use the `cors` function: `from quart_cors import cors`.
TypeError: cors() missing 1 required positional argument: 'app'
The `quart_cors.cors` function requires the Quart application instance as its first argument, but it was called without it or with incorrect arguments.
fixProvide the Quart application instance, for example: `cors(app, allow_origin="*")`.
Upgrade
Version history
0.8.0latest on PyPI · released Dec 27, 2024
Audit
Dependencies
quartrequiredCore web framework that quart-cors extends.
typing-extensionsrequiredProvides backported and experimental type hints.