@xof/cors

✨ Features

• ⚡ Lightweight and fast
• 🌐 Custom origin support
• 🔓 Wildcard origin support
• 🔒 Credentials support
• 🛠 HTTP methods configuration
• 📡 Automatic OPTIONS preflight handling
• 🎯 Multiple origin support
• 🔍 RegExp origin matching
• 📦 Easy middleware integration
• 🚀 Api compatible
• 🪶 Minimal dependencies

📦 Installation

npm

npm install @xof/cors

yarn

yarn add @xof/cors

pnpm

pnpm add @xof/cors

🚀 Basic Usage

API

const lynx = require("@xof/lynx");
const cors = require("@xof/cors");

const app = lynx();

app.use(cors());

app.get("/", (req, res) => {
  res.json({
    message: "Hello World"
  });
});

app.listen(3000, () => {
  console.log("Server running on port 3000");
});

⚙️ Configuration

The middleware accepts an options object.

Example:

const cors = require("@xof/cors");

app.use(cors({
  origin: "*",
  methods: [
    "GET",
    "POST"
  ],
  credentials: true
}));

📚 Options

origin

Controls which origins are allowed.

Default:

{
  origin: "*"
}

Allow All Origins

app.use(cors({
  origin: "*"
}));

Response:

Access-Control-Allow-Origin: *

Single Origin

app.use(cors({
  origin: "https://example.com"
}));

Multiple Origins

app.use(cors({
  origin: [
    "https://example.com",
    "https://app.example.com"
  ]
}));

RegExp Origin

app.use(cors({
  origin: /\.example\.com$/
}));

methods

Configure allowed HTTP methods.

Default:

GET,HEAD,PUT,PATCH,POST,DELETE

Example:

app.use(cors({
  methods: [
    "GET",
    "POST",
    "PUT",
    "DELETE"
  ]
}));

Generated header:

Access-Control-Allow-Methods:
GET,POST,PUT,DELETE

credentials

Enable credential support.

Example:

app.use(cors({
  credentials: true
}));

Generated header:

Access-Control-Allow-Credentials: true

allowedHeaders

Configure allowed request headers.

Example:

app.use(cors({
  allowedHeaders: [
    "Content-Type",
    "Authorization"
  ]
}));

Generated header:

Access-Control-Allow-Headers:
Content-Type,Authorization

exposedHeaders

Expose custom response headers.

Example:

app.use(cors({
  exposedHeaders: [
    "X-Custom-Header"
  ]
}));

Generated header:

Access-Control-Expose-Headers:
X-Custom-Header

maxAge

Set browser cache duration for preflight requests.

Example:

app.use(cors({
  maxAge: 86400
}));

Generated header:

Access-Control-Max-Age:
86400

preflightContinue

Continue middleware execution after OPTIONS request.

Default:

false

Example:

app.use(cors({
  preflightContinue: true
}));

optionsSuccessStatus

Configure OPTIONS response status.

Default:

204

Example:

app.use(cors({
  optionsSuccessStatus: 200
}));

🔥 Full Example

const lynx = require("@xof/lynx");
const cors = require("@xof/cors");

const app = lynx();

app.use(cors({
  origin: [
    "https://example.com",
    "https://app.example.com"
  ],

  methods: [
    "GET",
    "POST",
    "PUT",
    "DELETE"
  ],

  credentials: true,

  allowedHeaders: [
    "Content-Type",
    "Authorization"
  ],

  exposedHeaders: [
    "X-API-Version"
  ],

  maxAge: 86400
}));

app.get("/api", (req, res) => {
  res.json({
    status: "success"
  });
});

app.listen(3000);

🔄 Middleware Flow

Browser Request

        |
        v

OPTIONS Preflight

        |
        v

@xof/cors Middleware

        |
        +--> Check Origin
        |
        +--> Set Headers
        |
        +--> Handle Preflight

        |
        v

Application Route

📡 Generated Headers

This package manages:

Access-Control-Allow-Origin

Access-Control-Allow-Methods

Access-Control-Allow-Headers

Access-Control-Allow-Credentials

Access-Control-Max-Age

Access-Control-Expose-Headers

Vary

🧩 Compatibility

Supported environments:

Node.js
CommonJS
ES Module
REST API Server

📖 API Reference

Import:

const cors = require("@xof/cors");

Create middleware:

cors(options)

Returns:

API Middleware Function

🛡 Security Notes

CORS is a browser security mechanism.

It does not replace:

• Authentication
• Authorization
• Rate limiting
• API key protection
• Input validation
• Server-side security

For production applications, always configure your allowed origins carefully.

Example:

app.use(cors({
  origin: [
    "https://your-domain.com"
  ]
}));

Avoid allowing all origins (*) when your API handles sensitive data.

🐛 Bug Reports

Found a bug?

Please provide:

• Error message
• Node.js version
• Package version
• Minimal reproduction example
• Expected behavior

This helps improve the package faster.

🤝 Contributing

Contributions are welcome.

You can contribute by:

• Reporting bugs
• Suggesting features
• Improving documentation
• Submitting pull requests

Before submitting changes, please make sure your code follows the existing style.

📜 Changelog

1.0.0

Initial release.

Included features:

• Origin configuration
• Wildcard origin support
• Multiple origin support
• RegExp origin matching
• HTTP methods configuration
• Credentials support
• Allowed headers support
• Exposed headers support
• Preflight OPTIONS handling
• Max age configuration

📄 License

MIT License

Copyright (c) 2026 XOF

Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.

IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

⭐ Support

If this package helps your project:

• Give a star on GitHub
• Share it with developers
• Report issues
• Suggest improvements

🔗 Links

Repository:

https://github.com/Xyraakyzzz

NPM:

https://www.npmjs.com/package/@xof/cors

License

MIT © XOF