BreezeAPI CORS Middleware

A flexible CORS (Cross-Origin Resource Sharing) middleware for BreezeAPI.
Allows you to control which origins, methods, headers, and credentials are permitted for your API.

Features

• Allows all origins, methods, headers, and credentials by default (if no config is provided)
• Supports fine-grained configuration for:
  • Allowed origins (string, array, or function)
  • Allowed HTTP methods
  • Allowed request headers
  • Exposed response headers
  • Credentials (cookies/auth)
  • Preflight max age
  • Custom preflight response status
  • Continue to next middleware on preflight

Usage

import { corsMiddleware } from '@breezeapi/cors';

// Allow everything (default)
app.use(corsMiddleware());

// Restrict to specific origin
app.use(corsMiddleware({
  origin: 'https://example.com'
}));

// Allow multiple origins
app.use(corsMiddleware({
  origin: ['https://a.com', 'https://b.com']
}));

// Dynamic origin
app.use(corsMiddleware({
  origin: (req) => req.headers.get('origin') === 'https://example.com' ? 'https://example.com' : undefined
}));

// Full config example
app.use(corsMiddleware({
  origin: ['https://a.com', 'https://b.com'],
  methods: ['GET', 'POST', 'PUT'],
  allowedHeaders: ['Content-Type', 'Authorization'],
  exposedHeaders: ['X-Custom-Header'],
  credentials: true,
  maxAge: 86400,
  preflightContinue: false,
  optionsSuccessStatus: 204
}));

Configuration Options

| Option | Type | Default (if omitted) | Description | |----------------------|-----------------------------------|------------------------------|-----------------------------------------------------------------------------| | origin | string \| string[] \| boolean \| (req) => string\|string[] | * (all origins) | Allowed origin(s). Use a function for dynamic logic. | | methods | string \| string[] | All standard methods | Allowed HTTP methods. | | allowedHeaders | string \| string[] | All request headers | Allowed request headers. | | exposedHeaders | string \| string[] | * (all headers) | Headers exposed to the browser. | | credentials | boolean | true | Allow cookies/auth headers. | | maxAge | number | not set | How long (seconds) preflight can be cached. | | preflightContinue | boolean | false | Pass preflight to next middleware instead of ending response. | | optionsSuccessStatus| number | 204 | Status code for successful OPTIONS requests. |

Default Behavior

If you call corsMiddleware() with no arguments, everything is allowed:

• Any origin
• Any method
• Any header
• Credentials (cookies/auth) are allowed

License

MIT