cors-config-builder

CORS policy engine with origin matching, preflight handling, and footgun prevention.

Quick Start

import CORSBuilder from "cors-config-builder";

const cors = new CORSBuilder({
  origins: ["https://app.example.com", /^https:\/\/[\w-]+\.example\.com$/],
  methods: ["GET", "POST"],
  headers: ["Content-Type"],
  credentials: true,
  maxAge: 3600,
});

const response = cors.evaluate(request.origin, request.method);
// → { allowed: true, headers: { "Access-Control-Allow-Origin": "..." } }

API

Constructor

Accepts partial config; throws if credentials=true and origins=["*"] (security footgun).

evaluate(origin: string, method?: string)

Returns { allowed: boolean, headers: Record<string, string> } for preflight (OPTIONS) or regular requests.

Limits

• No actual middleware/interceptor binding (headers evaluation only)
• Credentials + wildcard-origin error prevents misconfiguration

Part of the ferrow-toolkit collection · Sponsored by Ferrow