@koa/cors

Cross-Origin Resource Sharing(CORS) for koa

Installation

1$ npm install @koa/cors --save

Quick start

Enable cors with default options:

• origin: request Origin header
• allowMethods: GET,HEAD,PUT,POST,DELETE,PATCH

1const Koa = require('koa');
2const cors = require('@koa/cors');
3
4const app = new Koa();
5app.use(cors());

cors(options)

1/**
2 * CORS middleware
3 *
4 * @param {Object} [options]
5 *  - {String|Function(ctx)} origin `Access-Control-Allow-Origin`, default is '*'
6 *    If `credentials` set and return `true, the `origin` default value will set to the request `Origin` header
7 *  - {String|Array} allowMethods `Access-Control-Allow-Methods`, default is 'GET,HEAD,PUT,POST,DELETE,PATCH'
8 *  - {String|Array} exposeHeaders `Access-Control-Expose-Headers`
9 *  - {String|Array} allowHeaders `Access-Control-Allow-Headers`
10 *  - {String|Number} maxAge `Access-Control-Max-Age` in seconds
11 *  - {Boolean|Function(ctx)} credentials `Access-Control-Allow-Credentials`, default is false.
12 *  - {Boolean} keepHeadersOnError Add set headers to `err.header` if an error is thrown
13 *  - {Boolean} secureContext `Cross-Origin-Opener-Policy` & `Cross-Origin-Embedder-Policy` headers.', default is false
14 *  - {Boolean} privateNetworkAccess handle `Access-Control-Request-Private-Network` request by return `Access-Control-Allow-Private-Network`, default to false
15 * @return {Function} cors middleware
16 * @api public
17 */

Breaking change between 5.0 and 4.0

The default origin is set to *, if you want to keep the 4.0 behavior, you can set the origin handler like this:

1app.use(cors({
2  origin(ctx) {
3    return ctx.get('Origin') || '*';
4  },
5}));

License

MIT

Contributors

fengmk2	dead-horse	omsmith	jonathanong	AlphaWong	cma-skedulo
CleberRossi	erikfried	j-waaang	ltomes	lfreneda	matthewmueller
PlasmaPower	swain	TyrealHu	xg-wang	lishengzxc	mcohen75

This project follows the git-contributor spec, auto updated at Sat Oct 08 2022 21:35:10 GMT+0800.