npmpackage.info

cors

Node.js CORS middleware

2.8.5

6,076

MIT

JavaScript

1.78 kB

2,200,523,313 3.8

Installations

npm install cors

Developer Guide

BETA

Typescript

No

Module System

CommonJS

Min. Node Version

>= 0.10

Node Version

8.12.0

NPM Version

6.4.1 Score

98.6

Supply Chain

99.5

Quality

79.4

Maintenance

100

Vulnerability

100

License

Pull Requests

Open

13

Total

102

Closed

45

Merged

44

Issues

Open

19

Total

116

Closed

97

Releases

Unable to fetch releases

Contributors

View all 72 contributors

Languages

JavaScript

JavaScript (100%)

Developer

expressjs

Download Statistics

Total Downloads

2,200,523,313

Last Day

557,189

Last Week

12,658,568

Last Month

54,058,547

Last Year

607,473,355

GitHub Statistics

6,076 Stars

324 Commits

471 Forks

85 Watching

2 Branches

72 Contributors

Bundle Size

4.32 kB

Minified

1.78 kB

Minified + Gzipped

Bundlephobia

Maintainers

Package Meta Information

Latest Version

2.8.5

Package Id

cors@2.8.5

Size

6.03 kB

NPM Version

6.4.1

Node Version

8.12.0

Publised On

04 Nov 2018

Total Downloads

Cumulative downloads

Total Downloads

2,200,523,313

Last day

-8.4%

557,189

Compared to previous day

Last week

-4.9%

12,658,568

Compared to previous week

Last month

-6.6%

54,058,547

Compared to previous month

Last year

17.3%

607,473,355

Compared to previous year

Daily Downloads

Weekly Downloads

Monthly Downloads

Yearly Downloads

Dependencies

object-assign vary

Dev Dependencies

after eslint express mocha nyc supertest

Versions

cors

CORS is a node.js package for providing a Connect/Express middleware that can be used to enable CORS with various options.

Follow me (@troygoode) on Twitter!

Installation
Usage
Configuration Options
Demo
License
Author

Installation

This is a Node.js module available through the npm registry. Installation is done using the npm install command:

1$ npm install cors

Usage

Simple Usage (Enable All CORS Requests)

1var express = require('express')
2var cors = require('cors')
3var app = express()
4
5app.use(cors())
6
7app.get('/products/:id', function (req, res, next) {
8  res.json({msg: 'This is CORS-enabled for all origins!'})
9})
10
11app.listen(80, function () {
12  console.log('CORS-enabled web server listening on port 80')
13})

Enable CORS for a Single Route

1var express = require('express')
2var cors = require('cors')
3var app = express()
4
5app.get('/products/:id', cors(), function (req, res, next) {
6  res.json({msg: 'This is CORS-enabled for a Single Route'})
7})
8
9app.listen(80, function () {
10  console.log('CORS-enabled web server listening on port 80')
11})

Configuring CORS

1var express = require('express')
2var cors = require('cors')
3var app = express()
4
5var corsOptions = {
6  origin: 'http://example.com',
7  optionsSuccessStatus: 200 // some legacy browsers (IE11, various SmartTVs) choke on 204
8}
9
10app.get('/products/:id', cors(corsOptions), function (req, res, next) {
11  res.json({msg: 'This is CORS-enabled for only example.com.'})
12})
13
14app.listen(80, function () {
15  console.log('CORS-enabled web server listening on port 80')
16})

Configuring CORS w/ Dynamic Origin

1var express = require('express')
2var cors = require('cors')
3var app = express()
4
5var whitelist = ['http://example1.com', 'http://example2.com']
6var corsOptions = {
7  origin: function (origin, callback) {
8    if (whitelist.indexOf(origin) !== -1) {
9      callback(null, true)
10    } else {
11      callback(new Error('Not allowed by CORS'))
12    }
13  }
14}
15
16app.get('/products/:id', cors(corsOptions), function (req, res, next) {
17  res.json({msg: 'This is CORS-enabled for a whitelisted domain.'})
18})
19
20app.listen(80, function () {
21  console.log('CORS-enabled web server listening on port 80')
22})

If you do not want to block REST tools or server-to-server requests, add a !origin check in the origin function like so:

1var corsOptions = {
2  origin: function (origin, callback) {
3    if (whitelist.indexOf(origin) !== -1 || !origin) {
4      callback(null, true)
5    } else {
6      callback(new Error('Not allowed by CORS'))
7    }
8  }
9}

Enabling CORS Pre-Flight

Certain CORS requests are considered 'complex' and require an initial OPTIONS request (called the "pre-flight request"). An example of a 'complex' CORS request is one that uses an HTTP verb other than GET/HEAD/POST (such as DELETE) or that uses custom headers. To enable pre-flighting, you must add a new OPTIONS handler for the route you want to support:

1var express = require('express')
2var cors = require('cors')
3var app = express()
4
5app.options('/products/:id', cors()) // enable pre-flight request for DELETE request
6app.del('/products/:id', cors(), function (req, res, next) {
7  res.json({msg: 'This is CORS-enabled for all origins!'})
8})
9
10app.listen(80, function () {
11  console.log('CORS-enabled web server listening on port 80')
12})

You can also enable pre-flight across-the-board like so:

1app.options('*', cors()) // include before other routes

Configuring CORS Asynchronously

1var express = require('express')
2var cors = require('cors')
3var app = express()
4
5var whitelist = ['http://example1.com', 'http://example2.com']
6var corsOptionsDelegate = function (req, callback) {
7  var corsOptions;
8  if (whitelist.indexOf(req.header('Origin')) !== -1) {
9    corsOptions = { origin: true } // reflect (enable) the requested origin in the CORS response
10  } else {
11    corsOptions = { origin: false } // disable CORS for this request
12  }
13  callback(null, corsOptions) // callback expects two parameters: error and options
14}
15
16app.get('/products/:id', cors(corsOptionsDelegate), function (req, res, next) {
17  res.json({msg: 'This is CORS-enabled for a whitelisted domain.'})
18})
19
20app.listen(80, function () {
21  console.log('CORS-enabled web server listening on port 80')
22})

Configuration Options

origin: Configures the Access-Control-Allow-Origin CORS header. Possible values:
- Boolean - set origin to true to reflect the request origin, as defined by req.header('Origin'), or set it to false to disable CORS.
- String - set origin to a specific origin. For example if you set it to "http://example.com" only requests from "http://example.com" will be allowed.
- RegExp - set origin to a regular expression pattern which will be used to test the request origin. If it's a match, the request origin will be reflected. For example the pattern /example\.com$/ will reflect any request that is coming from an origin ending with "example.com".
- Array - set origin to an array of valid origins. Each origin can be a String or a RegExp. For example ["http://example1.com", /\.example2\.com$/] will accept any request from "http://example1.com" or from a subdomain of "example2.com".
- Function - set origin to a function implementing some custom logic. The function takes the request origin as the first parameter and a callback (which expects the signature err [object], allow [bool]) as the second.
methods: Configures the Access-Control-Allow-Methods CORS header. Expects a comma-delimited string (ex: 'GET,PUT,POST') or an array (ex: ['GET', 'PUT', 'POST']).
allowedHeaders: Configures the Access-Control-Allow-Headers CORS header. Expects a comma-delimited string (ex: 'Content-Type,Authorization') or an array (ex: ['Content-Type', 'Authorization']). If not specified, defaults to reflecting the headers specified in the request's Access-Control-Request-Headers header.
exposedHeaders: Configures the Access-Control-Expose-Headers CORS header. Expects a comma-delimited string (ex: 'Content-Range,X-Content-Range') or an array (ex: ['Content-Range', 'X-Content-Range']). If not specified, no custom headers are exposed.
credentials: Configures the Access-Control-Allow-Credentials CORS header. Set to true to pass the header, otherwise it is omitted.
maxAge: Configures the Access-Control-Max-Age CORS header. Set to an integer to pass the header, otherwise it is omitted.
preflightContinue: Pass the CORS preflight response to the next handler.
optionsSuccessStatus: Provides a status code to use for successful OPTIONS requests, since some legacy browsers (IE11, various SmartTVs) choke on 204.

The default configuration is the equivalent of:

1{
2  "origin": "*",
3  "methods": "GET,HEAD,PUT,PATCH,POST,DELETE",
4  "preflightContinue": false,
5  "optionsSuccessStatus": 204
6}

For details on the effect of each CORS header, read this article on HTML5 Rocks.

Demo

A demo that illustrates CORS working (and not working) using jQuery is available here: http://node-cors-client.herokuapp.com/

Code for that demo can be found here:

Client: https://github.com/TroyGoode/node-cors-client
Server: https://github.com/TroyGoode/node-cors-server

License

MIT License

Author

Troy Goode (troygoode@gmail.com)

No vulnerabilities found.

10

Binary-Artifacts

Determines if the project has generated executable (binary) artifacts in the source repository.

10

Contributors

Determines if the project has a set of contributors from multiple organizations (e.g., companies).

10

Dangerous-Workflow

Determines if the project's GitHub Action workflows avoid dangerous patterns.

10

License

Determines if the project has defined a license.

10

Vulnerabilities

Determines if the project has open, known unfixed vulnerabilities.

3

Maintained

Determines if the project is "actively maintained".

2

Code-Review

Determines if the project requires human code review before pull requests (aka merge requests) are merged.

2

Pinned-Dependencies

Determines if the project has declared and pinned the dependencies of its build process.

1

CI-Tests

Determines if the project runs tests before pull requests are merged.

0

Branch-Protection

Determines if the default and release branches are protected with GitHub's branch protection settings.

0

CII-Best-Practices

Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.

0

Dependency-Update-Tool

Determines if the project uses a dependency update tool.

0

Fuzzing

Determines if the project uses fuzzing.

Reason

project is not fuzzed

Details

Warn: no OSSFuzz integration found: Follow the steps in https://github.com/google/oss-fuzz to integrate fuzzing for your project. Over time, try to add fuzzing for more functionalities of your project. (High effort)
Warn: no OneFuzz integration found: Follow the steps in https://github.com/microsoft/onefuzz to start fuzzing for your project. Over time, try to add fuzzing for more functionalities of your project. (High effort)
Warn: no GoBuiltInFuzzer integration found: Follow the steps in https://go.dev/doc/fuzz/ to enable fuzzing on your project. Over time, try to add fuzzing for more functionalities of your project. (Medium effort)
Warn: no PythonAtherisFuzzer integration found: Follow the steps in https://github.com/google/atheris to enable fuzzing on your project. Over time, try to add fuzzing for more functionalities of your project. (Medium effort)
Warn: no CLibFuzzer integration found: Follow the steps in https://llvm.org/docs/LibFuzzer.html to enable fuzzing on your project. Over time, try to add fuzzing for more functionalities of your project. (Medium effort)
Warn: no CppLibFuzzer integration found: Follow the steps in https://llvm.org/docs/LibFuzzer.html to enable fuzzing on your project. Over time, try to add fuzzing for more functionalities of your project. (Medium effort)
Warn: no SwiftLibFuzzer integration found: Follow the steps in https://google.github.io/oss-fuzz/getting-started/new-project-guide/swift-lang/ to enable fuzzing on your project. Over time, try to add fuzzing for more functionalities of your project. (Medium effort)
Warn: no RustCargoFuzzer integration found: Follow the steps in https://rust-fuzz.github.io/book/cargo-fuzz.html to enable fuzzing on your project. Over time, try to add fuzzing for more functionalities of your project. (Medium effort)
Warn: no JavaJazzerFuzzer integration found: Follow the steps in https://github.com/CodeIntelligenceTesting/jazzer to enable fuzzing on your project. Over time, try to add fuzzing for more functionalities of your project. (Medium effort)
Warn: no ClusterFuzzLite integration found: Follow the steps in https://github.com/google/clusterfuzzlite to integrate fuzzing as part of CI. Over time, try to add fuzzing for more functionalities of your project. (High effort)
Warn: no HaskellPropertyBasedTesting integration found: Use one of the following frameworks to fuzz your project: QuickCheck: https://hackage.haskell.org/package/QuickCheck hedgehog: https://hedgehog.qa/ validity: https://github.com/NorfairKing/validity smallcheck: https://hackage.haskell.org/package/smallcheck hspec: https://hspec.github.io/ tasty: https://hackage.haskell.org/package/tasty (High effort)
Warn: no TypeScriptPropertyBasedTesting integration found: Use fast-check: https://github.com/dubzzz/fast-check (High effort)
Warn: no JavaScriptPropertyBasedTesting integration found: Use fast-check: https://github.com/dubzzz/fast-check (High effort)

0

SAST

Determines if the project uses static code analysis.

0

Security-Policy

Determines if the project has published a security policy.

Reason

security policy file not detected

Details

Warn: no security policy file detected: On GitHub: Enable private vulnerability disclosure in your repository settings https://docs.github.com/en/code-security/security-advisories/repository-security-advisories/configuring-private-vulnerability-reporting-for-a-repository Add a section in your SECURITY.md indicating you have enabled private reporting, and tell them to follow the steps in https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability to report vulnerabilities. On GitLab: Add a section in your SECURITY.md indicating the process to disclose vulnerabilities for your project. Examples: https://github.com/ossf/scorecard/blob/main/SECURITY.md, https://github.com/slsa-framework/slsa-github-generator/blob/main/SECURITY.md, https://github.com/sigstore/.github/blob/main/SECURITY.md. For additional information on vulnerability disclosure, see https://github.com/ossf/oss-vulnerability-guide/blob/main/maintainer-guide.md. (Medium effort)
Warn: no security file to analyze: On GitHub: Enable private vulnerability disclosure in your repository settings https://docs.github.com/en/code-security/security-advisories/repository-security-advisories/configuring-private-vulnerability-reporting-for-a-repository Add a section in your SECURITY.md indicating you have enabled private reporting, and tell them to follow the steps in https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability to report vulnerabilities. On GitLab: Provide a point of contact in your SECURITY.md. Examples: https://github.com/ossf/scorecard/blob/main/SECURITY.md, https://github.com/slsa-framework/slsa-github-generator/blob/main/SECURITY.md, https://github.com/sigstore/.github/blob/main/SECURITY.md. (Low effort)
Warn: no security file to analyze: On GitHub: Enable private vulnerability disclosure in your repository settings https://docs.github.com/en/code-security/security-advisories/repository-security-advisories/configuring-private-vulnerability-reporting-for-a-repository Add a section in your SECURITY.md indicating you have enabled private reporting, and tell them to follow the steps in https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability to report vulnerabilities. On GitLab: Add a section in your SECURITY.md indicating the process to disclose vulnerabilities for your project. Examples: https://github.com/ossf/scorecard/blob/main/SECURITY.md, https://github.com/slsa-framework/slsa-github-generator/blob/main/SECURITY.md, https://github.com/sigstore/.github/blob/main/SECURITY.md. (Low effort)
Warn: no security file to analyze: On GitHub: Enable private vulnerability disclosure in your repository settings https://docs.github.com/en/code-security/security-advisories/repository-security-advisories/configuring-private-vulnerability-reporting-for-a-repository Add a section in your SECURITY.md indicating you have enabled private reporting, and tell them to follow the steps in https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability to report vulnerabilities. On GitLab: Add a section in your SECURITY.md indicating the process to disclose vulnerabilities for your project. Examples: https://github.com/ossf/scorecard/blob/main/SECURITY.md, https://github.com/slsa-framework/slsa-github-generator/blob/main/SECURITY.md, https://github.com/sigstore/.github/blob/main/SECURITY.md. (Low effort)

0

Token-Permissions

Determines if the project's workflows follow the principle of least privilege.

Score

3.8

/10

Last Scanned on 2024-12-23T21:22:13Z

The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.

Learn More

Other packages similar to cors

@types/cors

2.8.17

TypeScript definitions for cors

@koa/cors

5.0.0

Cross-Origin Resource Sharing(CORS) for koa

has-cors

1.1.0

Detects support for Cross-Origin Resource Sharing

egg-cors

3.0.1

cors plugin for egg