Registry / http-networking / restify-cors-middleware

restify-cors-middleware

JSON →
library1.1.1jsnpmunverified

restify-cors-middleware is a library providing W3C-compliant Cross-Origin Resource Sharing (CORS) middleware specifically designed for Restify servers. The current stable version is 1.1.1. This library offers robust control over allowed origins, headers, and preflight requests. Key differentiators include its dynamic handling of `Access-Control-Allow-Origin` by returning the matched origin rather than a simple wildcard, which enhances security. It supports flexible origin specification using strings, wildcards, and regular expressions. The package maintains compatibility with a broad range of Restify versions (2.6.x - 7.x.x) through its peer dependency. While a specific release cadence isn't documented, historical releases show updates addressing security concerns, such as the upgrade to Restify 4.1.x to fix a `negotiator` module vulnerability in version 0.0.7. It is predominantly used in CommonJS environments.

http-networkingauth-securityweb-framework
npm install restify-cors-middleware
github ↗package ↗
INSTALL
IMPORT
SIG · RESTIFY-CORS-MIDDL
R
restify-cors-middleware
http-networkingjavascriptv1.1.1
Install
—
Import
—
Disk
—
Pass rate
0/ 6
Env Coverage0 / 6
glibc
18–22
musl
18–22
Install & Compatibility
Where this runs
tested against v? · npm install
Install × environment matrix
Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux
musl
node 18–226 runs
build_error
glibc
node 18–226 runs
build_error
Code
Verified usage

Verified import paths — ran on the pinned version, not inferred.

corsMiddleware
✓ const corsMiddleware = require('restify-cors-middleware')
✗ import corsMiddleware from 'restify-cors-middleware'
This module is primarily CommonJS. While ESM interop might work, the standard and officially documented usage is `require()`.

This code sets up a basic Restify server with CORS protection, configuring allowed origins, headers, and demonstrating how to apply the preflight and actual CORS middleware.

const restify = require('restify'); const corsMiddleware = require('restify-cors-middleware'); const server = restify.createServer({ name: 'my-restify-app' }); const cors = corsMiddleware({ preflightMaxAge: 5, // Optional: cache preflight responses for 5 seconds origins: [ 'http://localhost:3000', // Example allowed client origin 'http://myfrontend.com', /^https?:\/\/staging\.myfrontend\.com(:[\d]+)?$/ // Regex for staging environment ], allowHeaders: ['API-Token', 'X-Requested-With'], // Headers client is allowed to send exposeHeaders: ['API-Token-Expiry', 'X-Custom-Header'] // Headers client is allowed to read }); server.pre(cors.preflight); // Handle preflight OPTIONS requests before routing server.use(cors.actual); // Handle actual CORS requests and apply headers server.get('/hello', (req, res, next) => { res.send({ message: 'Hello from Restify!' }); return next(); }); server.listen(8080, () => { console.log('%s listening at %s', server.name, server.url); });
Debug
Known issues
breakingOlder versions (prior to v0.0.7) of `restify-cors-middleware` might depend on `restify` versions vulnerable to security issues, specifically with the `negotiator` module. This could lead to potential security risks.
fix
Upgrade `restify-cors-middleware` to at least v0.0.7 and ensure your `restify` peer dependency is 4.1.X or newer to address known vulnerabilities.
affects: <0.0.7
gotchaWhile `origins: ['*']` is a valid configuration, it comes with significant security implications as it allows requests from any domain. The middleware's internal logic will still return the specific `Origin` from the request, but this does not mitigate the fundamental risk of an open CORS policy.
fix
Specify the exact list of allowed origins (strings or regular expressions) to limit cross-origin access to trusted domains only. Avoid `origins: ['*']` unless absolutely necessary and understood.
affects: >=0.0.1
gotchaRequests that do not include an `Origin` header (e.g., direct requests from the same origin, cURL requests without `-H 'Origin:...'`) will not receive any CORS-related response headers, as per the W3C spec. This can be a source of confusion during testing or for non-browser clients.
fix
Ensure that clients making cross-origin requests always include the `Origin` header. For testing purposes, manually add an `Origin` header to simulate browser behavior.
affects: >=0.0.1
gotchaWhen using reverse proxies (e.g., Varnish, Nginx, CDNs) in front of your Restify application, incorrect caching configurations can lead to CORS headers being served to the wrong requests. This happens if the proxy does not vary its cache based on the `Origin` request header.
fix
Configure your reverse proxy to include `Vary: Origin` in its caching policy. This ensures that different CORS responses (based on `Origin`) are cached separately, preventing unexpected behavior or security issues.
affects: >=0.0.1
Errors
Common errors & fixes
CORS headers are missing or incorrect for my client requests.
The client request might not be sending an `Origin` header, or the `Origin` header sent does not match any of the configured `origins` in the middleware.
fix
Verify that your client-side code sends an `Origin` header for cross-origin requests. Double-check the `origins` configuration in `corsMiddleware` to ensure the client's origin is correctly specified (using exact strings or a matching regular expression).
My caching layer is serving incorrect CORS headers to different clients.
A reverse proxy (like Varnish or a CDN) is caching responses without considering the `Origin` header, leading to an `Access-Control-Allow-Origin` value being served inappropriately to subsequent requests from different origins.
fix
Update your reverse proxy configuration to include `Vary: Origin` in its caching directives. This instructs the proxy to store separate cached versions for requests originating from different domains.
Security scanner reports vulnerability in 'negotiator' module or Restify dependency.
You are using an older version of `restify-cors-middleware` or `restify` that contains known vulnerabilities in its dependency tree, specifically affecting `negotiator`.
fix
Upgrade `restify-cors-middleware` to the latest stable version (1.1.1 or newer). Additionally, ensure your `restify` peer dependency is `4.1.X` or higher, as recommended by the `restify-cors-middleware` documentation since v0.0.7.
Upgrade
Version history
1.1.1latest on npm
Audit
Dependencies
restifyrequiredCore server framework that this middleware integrates with.
Agent activity
13 hits · last 30 days
node
12
OpenAI (training)
1
Resources
githubhttps://github.com/TabDigital/restify-cors-middleware ↗
packagehttps://www.npmjs.com/package/restify-cors-middleware ↗
restify-cors-middleware — npm install restify-cors-middleware · libregistry