@teamteanpm2024/deleniti-soluta-atque

CORS is a node.js package for providing a Connect/Express middleware that can be used to enable CORS with various options.

Follow me (@troygoode) on Twitter!

• Installation
• Usage
  • Simple Usage
  • Enable CORS for a Single Route
  • Configuring CORS
  • Configuring CORS w/ Dynamic Origin
  • Enabling CORS Pre-Flight
  • Configuring CORS Asynchronously
• Configuration Options
• Demo
• License
• Author

Installation

This is a Node.js module available through the npm registry. Installation is done using the npm install command:

1$ npm install @teamteanpm2024/deleniti-soluta-atque

Usage

Simple Usage (Enable All CORS Requests)

1var express = require('express')
2var @teamteanpm2024/deleniti-soluta-atque = require('@teamteanpm2024/deleniti-soluta-atque')
3var app = express()
4
5app.use(@teamteanpm2024/deleniti-soluta-atque())
6
7app.get('/products/:id', function (req, res, next) {
8  res.json({msg: 'This is CORS-enabled for all origins!'})
9})
10
11app.listen(80, function () {
12  console.log('CORS-enabled web server listening on port 80')
13})

Enable CORS for a Single Route

1var express = require('express')
2var @teamteanpm2024/deleniti-soluta-atque = require('@teamteanpm2024/deleniti-soluta-atque')
3var app = express()
4
5app.get('/products/:id', @teamteanpm2024/deleniti-soluta-atque(), function (req, res, next) {
6  res.json({msg: 'This is CORS-enabled for a Single Route'})
7})
8
9app.listen(80, function () {
10  console.log('CORS-enabled web server listening on port 80')
11})

Configuring CORS

1var express = require('express')
2var @teamteanpm2024/deleniti-soluta-atque = require('@teamteanpm2024/deleniti-soluta-atque')
3var app = express()
4
5var @teamteanpm2024/deleniti-soluta-atqueOptions = {
6  origin: 'http://example.com',
7  optionsSuccessStatus: 200 // some legacy browsers (IE11, various SmartTVs) choke on 204
8}
9
10app.get('/products/:id', @teamteanpm2024/deleniti-soluta-atque(@teamteanpm2024/deleniti-soluta-atqueOptions), function (req, res, next) {
11  res.json({msg: 'This is CORS-enabled for only example.com.'})
12})
13
14app.listen(80, function () {
15  console.log('CORS-enabled web server listening on port 80')
16})

Configuring CORS w/ Dynamic Origin

This module supports validating the origin dynamically using a function provided to the origin option. This function will be passed a string that is the origin (or undefined if the request has no origin), and a callback with the signature callback(error, origin).

The origin argument to the callback can be any value allowed for the origin option of the middleware, except a function. See the configuration options section for more information on all the possible value types.

This function is designed to allow the dynamic loading of allowed origin(s) from a backing datasource, like a database.

1var express = require('express')
2var @teamteanpm2024/deleniti-soluta-atque = require('@teamteanpm2024/deleniti-soluta-atque')
3var app = express()
4
5var @teamteanpm2024/deleniti-soluta-atqueOptions = {
6  origin: function (origin, callback) {
7    // db.loadOrigins is an example call to load
8    // a list of origins from a backing database
9    db.loadOrigins(function (error, origins) {
10      callback(error, origins)
11    })
12  }
13}
14
15app.get('/products/:id', @teamteanpm2024/deleniti-soluta-atque(@teamteanpm2024/deleniti-soluta-atqueOptions), function (req, res, next) {
16  res.json({msg: 'This is CORS-enabled for an allowed domain.'})
17})
18
19app.listen(80, function () {
20  console.log('CORS-enabled web server listening on port 80')
21})

Enabling CORS Pre-Flight

Certain CORS requests are considered 'complex' and require an initial OPTIONS request (called the "pre-flight request"). An example of a 'complex' CORS request is one that uses an HTTP verb other than GET/HEAD/POST (such as DELETE) or that uses custom headers. To enable pre-flighting, you must add a new OPTIONS handler for the route you want to support:

1var express = require('express')
2var @teamteanpm2024/deleniti-soluta-atque = require('@teamteanpm2024/deleniti-soluta-atque')
3var app = express()
4
5app.options('/products/:id', @teamteanpm2024/deleniti-soluta-atque()) // enable pre-flight request for DELETE request
6app.del('/products/:id', @teamteanpm2024/deleniti-soluta-atque(), function (req, res, next) {
7  res.json({msg: 'This is CORS-enabled for all origins!'})
8})
9
10app.listen(80, function () {
11  console.log('CORS-enabled web server listening on port 80')
12})

You can also enable pre-flight across-the-board like so:

1app.options('*', @teamteanpm2024/deleniti-soluta-atque()) // include before other routes

NOTE: When using this middleware as an application level middleware (for example, app.use(@teamteanpm2024/deleniti-soluta-atque())), pre-flight requests are already handled for all routes.

Configuring CORS Asynchronously

1var express = require('express')
2var @teamteanpm2024/deleniti-soluta-atque = require('@teamteanpm2024/deleniti-soluta-atque')
3var app = express()
4
5var allowlist = ['http://example1.com', 'http://example2.com']
6var @teamteanpm2024/deleniti-soluta-atqueOptionsDelegate = function (req, callback) {
7  var @teamteanpm2024/deleniti-soluta-atqueOptions;
8  if (allowlist.indexOf(req.header('Origin')) !== -1) {
9    @teamteanpm2024/deleniti-soluta-atqueOptions = { origin: true } // reflect (enable) the requested origin in the CORS response
10  } else {
11    @teamteanpm2024/deleniti-soluta-atqueOptions = { origin: false } // disable CORS for this request
12  }
13  callback(null, @teamteanpm2024/deleniti-soluta-atqueOptions) // callback expects two parameters: error and options
14}
15
16app.get('/products/:id', @teamteanpm2024/deleniti-soluta-atque(@teamteanpm2024/deleniti-soluta-atqueOptionsDelegate), function (req, res, next) {
17  res.json({msg: 'This is CORS-enabled for an allowed domain.'})
18})
19
20app.listen(80, function () {
21  console.log('CORS-enabled web server listening on port 80')
22})

Configuration Options

• origin: Configures the Access-Control-Allow-Origin CORS header. Possible values:
  • Boolean - set origin to true to reflect the request origin, as defined by req.header('Origin'), or set it to false to disable CORS.
  • String - set origin to a specific origin. For example if you set it to "http://example.com" only requests from "http://example.com" will be allowed.
  • RegExp - set origin to a regular expression pattern which will be used to test the request origin. If it's a match, the request origin will be reflected. For example the pattern /example\.com$/ will reflect any request that is coming from an origin ending with "example.com".
  • Array - set origin to an array of valid origins. Each origin can be a String or a RegExp. For example ["http://example1.com", /\.example2\.com$/] will accept any request from "http://example1.com" or from a subdomain of "example2.com".
  • Function - set origin to a function implementing some custom logic. The function takes the request origin as the first parameter and a callback (called as callback(err, origin), where origin is a non-function value of the origin option) as the second.
• methods: Configures the Access-Control-Allow-Methods CORS header. Expects a comma-delimited string (ex: 'GET,PUT,POST') or an array (ex: ['GET', 'PUT', 'POST']).
• allowedHeaders: Configures the Access-Control-Allow-Headers CORS header. Expects a comma-delimited string (ex: 'Content-Type,Authorization') or an array (ex: ['Content-Type', 'Authorization']). If not specified, defaults to reflecting the headers specified in the request's Access-Control-Request-Headers header.
• exposedHeaders: Configures the Access-Control-Expose-Headers CORS header. Expects a comma-delimited string (ex: 'Content-Range,X-Content-Range') or an array (ex: ['Content-Range', 'X-Content-Range']). If not specified, no custom headers are exposed.
• credentials: Configures the Access-Control-Allow-Credentials CORS header. Set to true to pass the header, otherwise it is omitted.
• maxAge: Configures the Access-Control-Max-Age CORS header. Set to an integer to pass the header, otherwise it is omitted.
• preflightContinue: Pass the CORS preflight response to the next handler.
• optionsSuccessStatus: Provides a status code to use for successful OPTIONS requests, since some legacy browsers (IE11, various SmartTVs) choke on 204.

The default configuration is the equivalent of:

1{
2  "origin": "*",
3  "methods": "GET,HEAD,PUT,PATCH,POST,DELETE",
4  "preflightContinue": false,
5  "optionsSuccessStatus": 204
6}

For details on the effect of each CORS header, read this article on web.dev.

Demo

A demo that illustrates CORS working (and not working) using React is available here: https://node-@teamteanpm2024/deleniti-soluta-atque-client.netlify.com

Code for that demo can be found here:

• Client: https://github.com/troygoode/node-@teamteanpm2024/deleniti-soluta-atque-client
• Server: https://github.com/troygoode/node-@teamteanpm2024/deleniti-soluta-atque-server

License

MIT License

Author

Troy Goode (troygoode@gmail.com)