npmpackage.info

cors

Node.js CORS middleware

2.8.5

6,070

MIT

JavaScript

1.78 kB

2,141,438,949

3.6

Installations

npm install cors

Score

98.6

Supply Chain

99.5

Quality

79.4

Maintenance

100

Vulnerability

100

License

Pull Requests

Open

10

Total

98

Closed

44

Merged

44

Issues

Open

23

Total

116

Closed

93

Releases

Unable to fetch releases

Contributors

View all 71 contributors

Developer

expressjs

Module System

BETA

CommonJS

Statistics

6,070 Stars

324 Commits

470 Forks

86 Watching

1 Branches

71 Contributors

Updated on 20 Nov 2024

Bundle Size

4.32 kB

Minified

1.78 kB

Minified + Gzipped

Bundlephobia

Languages

JavaScript (100%)

Total Downloads

Cumulative downloads

Total Downloads

2,141,438,949

Last day

-0.4%

2,585,042

Compared to previous day

Last week

2.6%

13,764,841

Compared to previous week

Last month

8.9%

57,743,619

Compared to previous month

Last year

15.9%

595,356,597

Compared to previous year

Daily Downloads

Weekly Downloads

Monthly Downloads

Yearly Downloads

Dependencies

vary object-assign

Dev Dependencies

nyc after mocha eslint express supertest

Versions

cors

CORS is a node.js package for providing a Connect/Express middleware that can be used to enable CORS with various options.

Follow me (@troygoode) on Twitter!

Installation
Usage
Configuration Options
Demo
License
Author

Installation

This is a Node.js module available through the npm registry. Installation is done using the npm install command:

1$ npm install cors

Usage

Simple Usage (Enable All CORS Requests)

1var express = require('express')
2var cors = require('cors')
3var app = express()
4
5app.use(cors())
6
7app.get('/products/:id', function (req, res, next) {
8  res.json({msg: 'This is CORS-enabled for all origins!'})
9})
10
11app.listen(80, function () {
12  console.log('CORS-enabled web server listening on port 80')
13})

Enable CORS for a Single Route

1var express = require('express')
2var cors = require('cors')
3var app = express()
4
5app.get('/products/:id', cors(), function (req, res, next) {
6  res.json({msg: 'This is CORS-enabled for a Single Route'})
7})
8
9app.listen(80, function () {
10  console.log('CORS-enabled web server listening on port 80')
11})

Configuring CORS

1var express = require('express')
2var cors = require('cors')
3var app = express()
4
5var corsOptions = {
6  origin: 'http://example.com',
7  optionsSuccessStatus: 200 // some legacy browsers (IE11, various SmartTVs) choke on 204
8}
9
10app.get('/products/:id', cors(corsOptions), function (req, res, next) {
11  res.json({msg: 'This is CORS-enabled for only example.com.'})
12})
13
14app.listen(80, function () {
15  console.log('CORS-enabled web server listening on port 80')
16})

Configuring CORS w/ Dynamic Origin

This module supports validating the origin dynamically using a function provided to the origin option. This function will be passed a string that is the origin (or undefined if the request has no origin), and a callback with the signature callback(error, origin).

The origin argument to the callback can be any value allowed for the origin option of the middleware, except a function. See the configuration options section for more information on all the possible value types.

This function is designed to allow the dynamic loading of allowed origin(s) from a backing datasource, like a database.

1var express = require('express')
2var cors = require('cors')
3var app = express()
4
5var corsOptions = {
6  origin: function (origin, callback) {
7    // db.loadOrigins is an example call to load
8    // a list of origins from a backing database
9    db.loadOrigins(function (error, origins) {
10      callback(error, origins)
11    })
12  }
13}
14
15app.get('/products/:id', cors(corsOptions), function (req, res, next) {
16  res.json({msg: 'This is CORS-enabled for an allowed domain.'})
17})
18
19app.listen(80, function () {
20  console.log('CORS-enabled web server listening on port 80')
21})

Enabling CORS Pre-Flight

Certain CORS requests are considered 'complex' and require an initial OPTIONS request (called the "pre-flight request"). An example of a 'complex' CORS request is one that uses an HTTP verb other than GET/HEAD/POST (such as DELETE) or that uses custom headers. To enable pre-flighting, you must add a new OPTIONS handler for the route you want to support:

1var express = require('express')
2var cors = require('cors')
3var app = express()
4
5app.options('/products/:id', cors()) // enable pre-flight request for DELETE request
6app.del('/products/:id', cors(), function (req, res, next) {
7  res.json({msg: 'This is CORS-enabled for all origins!'})
8})
9
10app.listen(80, function () {
11  console.log('CORS-enabled web server listening on port 80')
12})

You can also enable pre-flight across-the-board like so:

1app.options('*', cors()) // include before other routes

NOTE: When using this middleware as an application level middleware (for example, app.use(cors())), pre-flight requests are already handled for all routes.

Configuring CORS Asynchronously

1var express = require('express')
2var cors = require('cors')
3var app = express()
4
5var allowlist = ['http://example1.com', 'http://example2.com']
6var corsOptionsDelegate = function (req, callback) {
7  var corsOptions;
8  if (allowlist.indexOf(req.header('Origin')) !== -1) {
9    corsOptions = { origin: true } // reflect (enable) the requested origin in the CORS response
10  } else {
11    corsOptions = { origin: false } // disable CORS for this request
12  }
13  callback(null, corsOptions) // callback expects two parameters: error and options
14}
15
16app.get('/products/:id', cors(corsOptionsDelegate), function (req, res, next) {
17  res.json({msg: 'This is CORS-enabled for an allowed domain.'})
18})
19
20app.listen(80, function () {
21  console.log('CORS-enabled web server listening on port 80')
22})

Configuration Options

origin: Configures the Access-Control-Allow-Origin CORS header. Possible values:
- Boolean - set origin to true to reflect the request origin, as defined by req.header('Origin'), or set it to false to disable CORS.
- String - set origin to a specific origin. For example if you set it to "http://example.com" only requests from "http://example.com" will be allowed.
- RegExp - set origin to a regular expression pattern which will be used to test the request origin. If it's a match, the request origin will be reflected. For example the pattern /example\.com$/ will reflect any request that is coming from an origin ending with "example.com".
- Array - set origin to an array of valid origins. Each origin can be a String or a RegExp. For example ["http://example1.com", /\.example2\.com$/] will accept any request from "http://example1.com" or from a subdomain of "example2.com".
- Function - set origin to a function implementing some custom logic. The function takes the request origin as the first parameter and a callback (called as callback(err, origin), where origin is a non-function value of the origin option) as the second.
methods: Configures the Access-Control-Allow-Methods CORS header. Expects a comma-delimited string (ex: 'GET,PUT,POST') or an array (ex: ['GET', 'PUT', 'POST']).
allowedHeaders: Configures the Access-Control-Allow-Headers CORS header. Expects a comma-delimited string (ex: 'Content-Type,Authorization') or an array (ex: ['Content-Type', 'Authorization']). If not specified, defaults to reflecting the headers specified in the request's Access-Control-Request-Headers header.
exposedHeaders: Configures the Access-Control-Expose-Headers CORS header. Expects a comma-delimited string (ex: 'Content-Range,X-Content-Range') or an array (ex: ['Content-Range', 'X-Content-Range']). If not specified, no custom headers are exposed.
credentials: Configures the Access-Control-Allow-Credentials CORS header. Set to true to pass the header, otherwise it is omitted.
maxAge: Configures the Access-Control-Max-Age CORS header. Set to an integer to pass the header, otherwise it is omitted.
preflightContinue: Pass the CORS preflight response to the next handler.
optionsSuccessStatus: Provides a status code to use for successful OPTIONS requests, since some legacy browsers (IE11, various SmartTVs) choke on 204.

The default configuration is the equivalent of:

1{
2  "origin": "*",
3  "methods": "GET,HEAD,PUT,PATCH,POST,DELETE",
4  "preflightContinue": false,
5  "optionsSuccessStatus": 204
6}

For details on the effect of each CORS header, read this article on web.dev.

Demo

A demo that illustrates CORS working (and not working) using React is available here: https://node-cors-client.netlify.com

Code for that demo can be found here:

Client: https://github.com/troygoode/node-cors-client
Server: https://github.com/troygoode/node-cors-server

License

MIT License

Author

Troy Goode (troygoode@gmail.com)

No vulnerabilities found.

10

Binary-Artifacts

Determines if the project has generated executable (binary) artifacts in the source repository.

10

Contributors

Determines if the project has a set of contributors from multiple organizations (e.g., companies).

10

Dangerous-Workflow

Determines if the project's GitHub Action workflows avoid dangerous patterns.

10

License

Determines if the project has defined a license.

10

Vulnerabilities

Determines if the project has open, known unfixed vulnerabilities.

2

Code-Review

Determines if the project requires human code review before pull requests (aka merge requests) are merged.

2

Pinned-Dependencies

Determines if the project has declared and pinned the dependencies of its build process.

1

CI-Tests

Determines if the project runs tests before pull requests are merged.

1

Maintained

Determines if the project is "actively maintained".

0

Branch-Protection

Determines if the default and release branches are protected with GitHub's branch protection settings.

0

CII-Best-Practices

Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.

0

Dependency-Update-Tool

Determines if the project uses a dependency update tool.

0

Fuzzing

Determines if the project uses fuzzing.

Reason

project is not fuzzed

Details

Warn: no OSSFuzz integration found: Follow the steps in https://github.com/google/oss-fuzz to integrate fuzzing for your project. Over time, try to add fuzzing for more functionalities of your project. (High effort)
Warn: no OneFuzz integration found: Follow the steps in https://github.com/microsoft/onefuzz to start fuzzing for your project. Over time, try to add fuzzing for more functionalities of your project. (High effort)
Warn: no GoBuiltInFuzzer integration found: Follow the steps in https://go.dev/doc/fuzz/ to enable fuzzing on your project. Over time, try to add fuzzing for more functionalities of your project. (Medium effort)
Warn: no PythonAtherisFuzzer integration found: Follow the steps in https://github.com/google/atheris to enable fuzzing on your project. Over time, try to add fuzzing for more functionalities of your project. (Medium effort)
Warn: no CLibFuzzer integration found: Follow the steps in https://llvm.org/docs/LibFuzzer.html to enable fuzzing on your project. Over time, try to add fuzzing for more functionalities of your project. (Medium effort)
Warn: no CppLibFuzzer integration found: Follow the steps in https://llvm.org/docs/LibFuzzer.html to enable fuzzing on your project. Over time, try to add fuzzing for more functionalities of your project. (Medium effort)
Warn: no SwiftLibFuzzer integration found: Follow the steps in https://google.github.io/oss-fuzz/getting-started/new-project-guide/swift-lang/ to enable fuzzing on your project. Over time, try to add fuzzing for more functionalities of your project. (Medium effort)
Warn: no RustCargoFuzzer integration found: Follow the steps in https://rust-fuzz.github.io/book/cargo-fuzz.html to enable fuzzing on your project. Over time, try to add fuzzing for more functionalities of your project. (Medium effort)
Warn: no JavaJazzerFuzzer integration found: Follow the steps in https://github.com/CodeIntelligenceTesting/jazzer to enable fuzzing on your project. Over time, try to add fuzzing for more functionalities of your project. (Medium effort)
Warn: no ClusterFuzzLite integration found: Follow the steps in https://github.com/google/clusterfuzzlite to integrate fuzzing as part of CI. Over time, try to add fuzzing for more functionalities of your project. (High effort)
Warn: no HaskellPropertyBasedTesting integration found: Use one of the following frameworks to fuzz your project: QuickCheck: https://hackage.haskell.org/package/QuickCheck hedgehog: https://hedgehog.qa/ validity: https://github.com/NorfairKing/validity smallcheck: https://hackage.haskell.org/package/smallcheck hspec: https://hspec.github.io/ tasty: https://hackage.haskell.org/package/tasty (High effort)
Warn: no TypeScriptPropertyBasedTesting integration found: Use fast-check: https://github.com/dubzzz/fast-check (High effort)
Warn: no JavaScriptPropertyBasedTesting integration found: Use fast-check: https://github.com/dubzzz/fast-check (High effort)

0

SAST

Determines if the project uses static code analysis.

0

Security-Policy

Determines if the project has published a security policy.

Reason

security policy file not detected

Details

Warn: no security policy file detected: On GitHub: Enable private vulnerability disclosure in your repository settings https://docs.github.com/en/code-security/security-advisories/repository-security-advisories/configuring-private-vulnerability-reporting-for-a-repository Add a section in your SECURITY.md indicating you have enabled private reporting, and tell them to follow the steps in https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability to report vulnerabilities. On GitLab: Add a section in your SECURITY.md indicating the process to disclose vulnerabilities for your project. Examples: https://github.com/ossf/scorecard/blob/main/SECURITY.md, https://github.com/slsa-framework/slsa-github-generator/blob/main/SECURITY.md, https://github.com/sigstore/.github/blob/main/SECURITY.md. For additional information on vulnerability disclosure, see https://github.com/ossf/oss-vulnerability-guide/blob/main/maintainer-guide.md. (Medium effort)
Warn: no security file to analyze: On GitHub: Enable private vulnerability disclosure in your repository settings https://docs.github.com/en/code-security/security-advisories/repository-security-advisories/configuring-private-vulnerability-reporting-for-a-repository Add a section in your SECURITY.md indicating you have enabled private reporting, and tell them to follow the steps in https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability to report vulnerabilities. On GitLab: Provide a point of contact in your SECURITY.md. Examples: https://github.com/ossf/scorecard/blob/main/SECURITY.md, https://github.com/slsa-framework/slsa-github-generator/blob/main/SECURITY.md, https://github.com/sigstore/.github/blob/main/SECURITY.md. (Low effort)
Warn: no security file to analyze: On GitHub: Enable private vulnerability disclosure in your repository settings https://docs.github.com/en/code-security/security-advisories/repository-security-advisories/configuring-private-vulnerability-reporting-for-a-repository Add a section in your SECURITY.md indicating you have enabled private reporting, and tell them to follow the steps in https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability to report vulnerabilities. On GitLab: Add a section in your SECURITY.md indicating the process to disclose vulnerabilities for your project. Examples: https://github.com/ossf/scorecard/blob/main/SECURITY.md, https://github.com/slsa-framework/slsa-github-generator/blob/main/SECURITY.md, https://github.com/sigstore/.github/blob/main/SECURITY.md. (Low effort)
Warn: no security file to analyze: On GitHub: Enable private vulnerability disclosure in your repository settings https://docs.github.com/en/code-security/security-advisories/repository-security-advisories/configuring-private-vulnerability-reporting-for-a-repository Add a section in your SECURITY.md indicating you have enabled private reporting, and tell them to follow the steps in https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability to report vulnerabilities. On GitLab: Add a section in your SECURITY.md indicating the process to disclose vulnerabilities for your project. Examples: https://github.com/ossf/scorecard/blob/main/SECURITY.md, https://github.com/slsa-framework/slsa-github-generator/blob/main/SECURITY.md, https://github.com/sigstore/.github/blob/main/SECURITY.md. (Low effort)

0

Token-Permissions

Determines if the project's workflows follow the principle of least privilege.

Score

3.6

/10

Last Scanned on 2024-11-18T21:22:36Z

The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.

Learn More

Other packages similar to cors

http-proxy-middleware

3.0.3

The one-liner node.js proxy middleware for connect, express, next.js and more

@fastify/cors

10.0.1

Fastify CORS

@koa/cors

5.0.0

Cross-Origin Resource Sharing(CORS) for koa

cdk-cors-proxy

0.0.270

A proxy to make an endpoint CORS-compatible