CORS

Learn CORS with the cors middleware.

What is CORS?

CORS (Cross-Origin Resource Sharing) is the mechanism that lets a browser allow or deny requests from another origin. By default the browser blocks cross-origin requests (same-origin policy).

In Express you set CORS headers with the cors middleware. app.use(cors()) allows all origins. In production it is safer to allow specific origins: cors({ origin: "https://mysite.com" }).

The cors() middleware

Wiring the cors module into Express is simple. Import it with const cors = require("cors"), then apply it with app.use(cors()). Every response gets the Access-Control-Allow-Origin: * header.

There are customization options. You can list allowed origins with cors({ origin: [...] }) and restrict methods with cors({ methods: ["GET", "POST"] }). OPTIONS requests (preflight) are answered automatically.

Exercise Log the type of cors

Import the cors module. Log typeof cors.

Show example solution

const cors = require("cors");
console.log(typeof cors);

Test yourself

Complete the module name

const cors = require("____")

Show answer

const cors = require("cors")

What does CORS provide?
- Encryption
- A database connection
- File compression
- Allows cross-origin requests
Show answer

Allows cross-origin requests — CORS allows cross-origin requests.
Match each piece to its role

cors

Cross-origin
Access-Control-Allow-Origin

Allowed origin
app.use(cors())

Enables CORS
preflight

Pre-request

Next lesson: Rate limiting

We Are Enhancing Your Experience

Cookie Preferences

Strictly Necessary Cookies

Analytical Cookies