@starefossen/express-cors

Smart CORS headers middleware for your Express.js applications.

Install

$ npm install @starefossen/express-cors --save

Usage

const cors = require('@starefossen/express-cors');

Simple

The simple configuration is controlled by environment variables:

| Variable | Description | Default | |----------|-------------|---------| | CORS_ALLOW_CREDENTIALS | allow-credentials (boolean) | undefined | | CORS_ALLOW_HEADERS | allow-headers header (comma separated string) | Content-Type | | CORS_ALLOW_METHODS | allow-methods header (comma separated string) | GET, OPTIONS | | CORS_ALLOW_ORIGINS | orins whitelist (comma seperated string) | "" | | CORS_DENY_ORIGINS | origins blacklist (comma seperated string) | "" | | CORS_EXPOSE_HEADERS | expose-headers header (comma seperated string) | "" | | CORS_MAX_AGE | max-age header (integer) | 0 | | CORS_REQUIRE_ORIGIN | require origin header from client (boolean) | false |

const cors = require('@starefossen/express-cors');

app.use(cors.middleware);

Advanced

The advanced configuration takes in a configuration object. All values defaults to their environment conunterpart as statated in the simple configuration.

const cors = require('@starefossen/express-cors');

app.use(cors({
  allowCredentials: false,
  allowHeaders: 'Content-Type',
  allowMethods: 'GET, OPTIONS',
  allowOrigins: 'foo.com,bar.com',
  denyOrigins: 'example.com',
  exposeHeaders: 'x-request-time',
  maxAge: 133734,
  requireOrigin: true,
});

Localhost

If you want to allow local development domains like localhost or file:// you can add the following to your CORS_ALLOW_ORIGINS environment variable:

CORS_ALLOW_ORIGINS='localhost,null'

MIT Licensed