Gathering detailed insights and metrics for cors
Gathering detailed insights and metrics for cors
Gathering detailed insights and metrics for cors
Gathering detailed insights and metrics for cors
npm install cors
Typescript
Module System
Min. Node Version
Node Version
NPM Version
JavaScript (100%)
Total Downloads
2,652,994,848
Last Day
3,468,009
Last Week
19,628,447
Last Month
90,880,440
Last Year
746,209,485
MIT License
6,143 Stars
338 Commits
483 Forks
85 Watchers
2 Branches
71 Contributors
Updated on Jul 10, 2025
Latest Version
2.8.5
Package Id
cors@2.8.5
Size
6.03 kB
NPM Version
6.4.1
Node Version
8.12.0
Published on
Nov 04, 2018
Cumulative downloads
Total Downloads
Last Day
1.2%
3,468,009
Compared to previous day
Last Week
-4.6%
19,628,447
Compared to previous week
Last Month
9.6%
90,880,440
Compared to previous month
Last Year
34.2%
746,209,485
Compared to previous year
CORS is a node.js package for providing a Connect/Express middleware that can be used to enable CORS with various options.
Follow me (@troygoode) on Twitter!
This is a Node.js module available through the
npm registry. Installation is done using the
npm install
command:
1$ npm install cors
1var express = require('express') 2var cors = require('cors') 3var app = express() 4 5app.use(cors()) 6 7app.get('/products/:id', function (req, res, next) { 8 res.json({msg: 'This is CORS-enabled for all origins!'}) 9}) 10 11app.listen(80, function () { 12 console.log('CORS-enabled web server listening on port 80') 13})
1var express = require('express') 2var cors = require('cors') 3var app = express() 4 5app.get('/products/:id', cors(), function (req, res, next) { 6 res.json({msg: 'This is CORS-enabled for a Single Route'}) 7}) 8 9app.listen(80, function () { 10 console.log('CORS-enabled web server listening on port 80') 11})
1var express = require('express') 2var cors = require('cors') 3var app = express() 4 5var corsOptions = { 6 origin: 'http://example.com', 7 optionsSuccessStatus: 200 // some legacy browsers (IE11, various SmartTVs) choke on 204 8} 9 10app.get('/products/:id', cors(corsOptions), function (req, res, next) { 11 res.json({msg: 'This is CORS-enabled for only example.com.'}) 12}) 13 14app.listen(80, function () { 15 console.log('CORS-enabled web server listening on port 80') 16})
1var express = require('express') 2var cors = require('cors') 3var app = express() 4 5var whitelist = ['http://example1.com', 'http://example2.com'] 6var corsOptions = { 7 origin: function (origin, callback) { 8 if (whitelist.indexOf(origin) !== -1) { 9 callback(null, true) 10 } else { 11 callback(new Error('Not allowed by CORS')) 12 } 13 } 14} 15 16app.get('/products/:id', cors(corsOptions), function (req, res, next) { 17 res.json({msg: 'This is CORS-enabled for a whitelisted domain.'}) 18}) 19 20app.listen(80, function () { 21 console.log('CORS-enabled web server listening on port 80') 22})
If you do not want to block REST tools or server-to-server requests,
add a !origin
check in the origin function like so:
1var corsOptions = { 2 origin: function (origin, callback) { 3 if (whitelist.indexOf(origin) !== -1 || !origin) { 4 callback(null, true) 5 } else { 6 callback(new Error('Not allowed by CORS')) 7 } 8 } 9}
Certain CORS requests are considered 'complex' and require an initial
OPTIONS
request (called the "pre-flight request"). An example of a
'complex' CORS request is one that uses an HTTP verb other than
GET/HEAD/POST (such as DELETE) or that uses custom headers. To enable
pre-flighting, you must add a new OPTIONS handler for the route you want
to support:
1var express = require('express') 2var cors = require('cors') 3var app = express() 4 5app.options('/products/:id', cors()) // enable pre-flight request for DELETE request 6app.del('/products/:id', cors(), function (req, res, next) { 7 res.json({msg: 'This is CORS-enabled for all origins!'}) 8}) 9 10app.listen(80, function () { 11 console.log('CORS-enabled web server listening on port 80') 12})
You can also enable pre-flight across-the-board like so:
1app.options('*', cors()) // include before other routes
1var express = require('express') 2var cors = require('cors') 3var app = express() 4 5var whitelist = ['http://example1.com', 'http://example2.com'] 6var corsOptionsDelegate = function (req, callback) { 7 var corsOptions; 8 if (whitelist.indexOf(req.header('Origin')) !== -1) { 9 corsOptions = { origin: true } // reflect (enable) the requested origin in the CORS response 10 } else { 11 corsOptions = { origin: false } // disable CORS for this request 12 } 13 callback(null, corsOptions) // callback expects two parameters: error and options 14} 15 16app.get('/products/:id', cors(corsOptionsDelegate), function (req, res, next) { 17 res.json({msg: 'This is CORS-enabled for a whitelisted domain.'}) 18}) 19 20app.listen(80, function () { 21 console.log('CORS-enabled web server listening on port 80') 22})
origin
: Configures the Access-Control-Allow-Origin CORS header. Possible values:
Boolean
- set origin
to true
to reflect the request origin, as defined by req.header('Origin')
, or set it to false
to disable CORS.String
- set origin
to a specific origin. For example if you set it to "http://example.com"
only requests from "http://example.com" will be allowed.RegExp
- set origin
to a regular expression pattern which will be used to test the request origin. If it's a match, the request origin will be reflected. For example the pattern /example\.com$/
will reflect any request that is coming from an origin ending with "example.com".Array
- set origin
to an array of valid origins. Each origin can be a String
or a RegExp
. For example ["http://example1.com", /\.example2\.com$/]
will accept any request from "http://example1.com" or from a subdomain of "example2.com".Function
- set origin
to a function implementing some custom logic. The function takes the request origin as the first parameter and a callback (which expects the signature err [object], allow [bool]
) as the second.methods
: Configures the Access-Control-Allow-Methods CORS header. Expects a comma-delimited string (ex: 'GET,PUT,POST') or an array (ex: ['GET', 'PUT', 'POST']
).allowedHeaders
: Configures the Access-Control-Allow-Headers CORS header. Expects a comma-delimited string (ex: 'Content-Type,Authorization') or an array (ex: ['Content-Type', 'Authorization']
). If not specified, defaults to reflecting the headers specified in the request's Access-Control-Request-Headers header.exposedHeaders
: Configures the Access-Control-Expose-Headers CORS header. Expects a comma-delimited string (ex: 'Content-Range,X-Content-Range') or an array (ex: ['Content-Range', 'X-Content-Range']
). If not specified, no custom headers are exposed.credentials
: Configures the Access-Control-Allow-Credentials CORS header. Set to true
to pass the header, otherwise it is omitted.maxAge
: Configures the Access-Control-Max-Age CORS header. Set to an integer to pass the header, otherwise it is omitted.preflightContinue
: Pass the CORS preflight response to the next handler.optionsSuccessStatus
: Provides a status code to use for successful OPTIONS
requests, since some legacy browsers (IE11, various SmartTVs) choke on 204
.The default configuration is the equivalent of:
1{ 2 "origin": "*", 3 "methods": "GET,HEAD,PUT,PATCH,POST,DELETE", 4 "preflightContinue": false, 5 "optionsSuccessStatus": 204 6}
For details on the effect of each CORS header, read this article on HTML5 Rocks.
A demo that illustrates CORS working (and not working) using jQuery is available here: http://node-cors-client.herokuapp.com/
Code for that demo can be found here:
No vulnerabilities found.
Reason
no dangerous workflow patterns detected
Reason
no binaries found in the repo
Reason
GitHub workflow tokens follow principle of least privilege
Details
Reason
13 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
Reason
update tool detected
Details
Reason
0 existing vulnerabilities detected
Reason
license file detected
Details
Reason
security policy file detected
Details
Reason
project has 8 contributing companies or organizations
Details
Reason
SAST tool detected but not run on all commits
Details
Reason
dependency not pinned by hash detected -- score normalized to 6
Details
Reason
13 out of 20 merged PRs checked by a CI test -- score normalized to 6
Reason
Found 12/23 approved changesets -- score normalized to 5
Reason
no effort to earn an OpenSSF best practices badge detected
Reason
project is not fuzzed
Details
Reason
branch protection not enabled on development/release branches
Details
Score
Last Scanned on 2025-07-07T21:24:14Z
The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.
Learn More