npmpackage.info

Gathering detailed insights and metrics for @koa/cors

As of June 2024, the npm registry hosts over 2 million packages, making it one of the largest open-source software repositories in the world.

@koa/cors

Cross-Origin Resource Sharing(CORS) for koa

5.0.0

732

NOASSERTION

JavaScript

113,252,463

5.4

Installations

npm install @koa/cors

Score

99.6

Supply Chain

95.5

Quality

83.5

Maintenance

100

Vulnerability

100

License

Pull Requests

Open

7

Total

48

Closed

16

Merged

25

Issues

Open

15

Total

45

Closed

30

Releases

Unable to fetch releases

Contributors

View all 30 contributors

Developer

koajs

Module System

BETA

CommonJS

Statistics

732 Stars

61 Commits

80 Forks

16 Watching

3 Branches

30 Contributors

Updated on 01 Nov 2024

Languages

JavaScript (100%)

Total Downloads

Cumulative downloads

Total Downloads

113,252,463

Last day

3.7%

140,037

Compared to previous day

Last week

3.2%

706,452

Compared to previous week

Last month

7.6%

2,985,710

Compared to previous month

Last year

3.6%

30,231,573

Compared to previous year

Daily Downloads

Weekly Downloads

Monthly Downloads

Yearly Downloads

Dependencies

vary

Dev Dependencies

egg-ci eslint eslint-config-egg git-contributor istanbul koa mocha supertest

Versions

@koa/cors

Cross-Origin Resource Sharing(CORS) for koa

Installation

1$ npm install @koa/cors --save

Quick start

Enable cors with default options:

origin: * (v4 and before: the request's Origin header). This means that by default the requests from all origin webpages will be allowed. If you're running a generic API server, this is what you want, but otherwise you should look into changing the default to something more suitable to your application.
allowMethods: GET,HEAD,PUT,POST,DELETE,PATCH

1const Koa = require('koa');
2const cors = require('@koa/cors');
3
4const app = new Koa();
5app.use(cors());

cors(options)

1/**
2 * CORS middleware
3 *
4 * @param {Object} [options]
5 *  - {String|Function(ctx)} origin `Access-Control-Allow-Origin`, default is '*'
6 *    If `credentials` set and return `true, the `origin` default value will set to the request `Origin` header
7 *  - {String|Array} allowMethods `Access-Control-Allow-Methods`, default is 'GET,HEAD,PUT,POST,DELETE,PATCH'
8 *  - {String|Array} exposeHeaders `Access-Control-Expose-Headers`
9 *  - {String|Array} allowHeaders `Access-Control-Allow-Headers`
10 *  - {String|Number} maxAge `Access-Control-Max-Age` in seconds
11 *  - {Boolean|Function(ctx)} credentials `Access-Control-Allow-Credentials`, default is false.
12 *  - {Boolean} keepHeadersOnError Add set headers to `err.header` if an error is thrown
13 *  - {Boolean} secureContext `Cross-Origin-Opener-Policy` & `Cross-Origin-Embedder-Policy` headers.', default is false
14 *  - {Boolean} privateNetworkAccess handle `Access-Control-Request-Private-Network` request by return `Access-Control-Allow-Private-Network`, default to false
15 * @return {Function} cors middleware
16 * @api public
17 */

Breaking change between 4.0 and 5.0

The default origin is set to *, if you want to keep the 4.0 behavior, you can set the origin handler like this:

1app.use(cors({
2  origin(ctx) {
3    return ctx.get('Origin') || '*';
4  },
5}));

License

MIT

Contributors

_fengmk2	_dead-horse	_omsmith	_jonathanong	_AlphaWong	_cma-skedulo
_CleberRossi	_erikfried	_j-waaang	_ltomes	_lfreneda	_{matthewmueller}
_PlasmaPower	_swain	_TyrealHu	_xg-wang	_lishengzxc	_mcohen75

This project follows the git-contributor spec, auto updated at Sat Oct 08 2022 21:35:10 GMT+0800.

Stable Version

The latest stable version of the package.

Stable Version

5.0.0

HIGH

8.6/10

Summary

Overly permissive origin policy

Affected Versions

< 5.0.0

Patched Versions

5.0.0

10

Dangerous-Workflow

Determines if the project's GitHub Action workflows avoid dangerous patterns.

10

Binary-Artifacts

Determines if the project has generated executable (binary) artifacts in the source repository.

10

Vulnerabilities

Determines if the project has open, known unfixed vulnerabilities.

10

Security-Policy

Determines if the project has published a security policy.

9

License

Determines if the project has defined a license.

7

SAST

Determines if the project uses static code analysis.

3

Code-Review

Determines if the project requires human code review before pull requests (aka merge requests) are merged.

2

Pinned-Dependencies

Determines if the project has declared and pinned the dependencies of its build process.

0

Maintained

Determines if the project is "actively maintained".

0

CII-Best-Practices

Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.

0

Token-Permissions

Determines if the project's workflows follow the principle of least privilege.

0

Fuzzing

Determines if the project uses fuzzing.

Score

5.4

/10

Last Scanned on 2024-11-11

The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.

Learn More

Other packages similar to @koa/cors

koa-micro-ts

4.0.2

Microservice Typescript Framework - based on koa

@zenweb/cors

5.1.0

zenweb cors module

orogeny-cors-koa-npm

1.2.3

Adexe Created Npm Publish store to check for the client purpose Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris

private-cors-eclipse-koa

1.2.3