|
# cors |
|
|
|
[![NPM Version][npm-image]][npm-url] |
|
[![NPM Downloads][downloads-image]][downloads-url] |
|
[![Build Status][travis-image]][travis-url] |
|
[![Test Coverage][coveralls-image]][coveralls-url] |
|
|
|
CORS is a node.js package for providing a [Connect](http://www.senchalabs.org/connect/)/[Express](http://expressjs.com/) middleware that can be used to enable [CORS](http://en.wikipedia.org/wiki/Cross-origin_resource_sharing) with various options. |
|
|
|
**[Follow me (@troygoode) on Twitter!](https://twitter.com/intent/user?screen_name=troygoode)** |
|
|
|
* [Installation](#installation) |
|
* [Usage](#usage) |
|
* [Simple Usage](#simple-usage-enable-all-cors-requests) |
|
* [Enable CORS for a Single Route](#enable-cors-for-a-single-route) |
|
* [Configuring CORS](#configuring-cors) |
|
* [Configuring CORS Asynchronously](#configuring-cors-asynchronously) |
|
* [Enabling CORS Pre-Flight](#enabling-cors-pre-flight) |
|
* [Configuration Options](#configuration-options) |
|
* [Demo](#demo) |
|
* [License](#license) |
|
* [Author](#author) |
|
|
|
## Installation |
|
|
|
This is a [Node.js](https://nodejs.org/en/) module available through the |
|
[npm registry](https://www.npmjs.com/). Installation is done using the |
|
[`npm install` command](https://docs.npmjs.com/getting-started/installing-npm-packages-locally): |
|
|
|
```sh |
|
$ npm install cors |
|
``` |
|
|
|
## Usage |
|
|
|
### Simple Usage (Enable *All* CORS Requests) |
|
|
|
```javascript |
|
var express = require('express') |
|
var cors = require('cors') |
|
var app = express() |
|
|
|
app.use(cors()) |
|
|
|
app.get('/products/:id', function (req, res, next) { |
|
res.json({msg: 'This is CORS-enabled for all origins!'}) |
|
}) |
|
|
|
app.listen(80, function () { |
|
console.log('CORS-enabled web server listening on port 80') |
|
}) |
|
``` |
|
|
|
### Enable CORS for a Single Route |
|
|
|
```javascript |
|
var express = require('express') |
|
var cors = require('cors') |
|
var app = express() |
|
|
|
app.get('/products/:id', cors(), function (req, res, next) { |
|
res.json({msg: 'This is CORS-enabled for a Single Route'}) |
|
}) |
|
|
|
app.listen(80, function () { |
|
console.log('CORS-enabled web server listening on port 80') |
|
}) |
|
``` |
|
|
|
### Configuring CORS |
|
|
|
```javascript |
|
var express = require('express') |
|
var cors = require('cors') |
|
var app = express() |
|
|
|
var corsOptions = { |
|
origin: 'http://example.com', |
|
optionsSuccessStatus: 200 // some legacy browsers (IE11, various SmartTVs) choke on 204 |
|
} |
|
|
|
app.get('/products/:id', cors(corsOptions), function (req, res, next) { |
|
res.json({msg: 'This is CORS-enabled for only example.com.'}) |
|
}) |
|
|
|
app.listen(80, function () { |
|
console.log('CORS-enabled web server listening on port 80') |
|
}) |
|
``` |
|
|
|
### Configuring CORS w/ Dynamic Origin |
|
|
|
```javascript |
|
var express = require('express') |
|
var cors = require('cors') |
|
var app = express() |
|
|
|
var whitelist = ['http://example1.com', 'http://example2.com'] |
|
var corsOptions = { |
|
origin: function (origin, callback) { |
|
if (whitelist.indexOf(origin) !== -1) { |
|
callback(null, true) |
|
} else { |
|
callback(new Error('Not allowed by CORS')) |
|
} |
|
} |
|
} |
|
|
|
app.get('/products/:id', cors(corsOptions), function (req, res, next) { |
|
res.json({msg: 'This is CORS-enabled for a whitelisted domain.'}) |
|
}) |
|
|
|
app.listen(80, function () { |
|
console.log('CORS-enabled web server listening on port 80') |
|
}) |
|
``` |
|
|
|
If you do not want to block REST tools or server-to-server requests, |
|
add a `!origin` check in the origin function like so: |
|
|
|
```javascript |
|
var corsOptions = { |
|
origin: function (origin, callback) { |
|
if (whitelist.indexOf(origin) !== -1 || !origin) { |
|
callback(null, true) |
|
} else { |
|
callback(new Error('Not allowed by CORS')) |
|
} |
|
} |
|
} |
|
``` |
|
|
|
### Enabling CORS Pre-Flight |
|
|
|
Certain CORS requests are considered 'complex' and require an initial |
|
`OPTIONS` request (called the "pre-flight request"). An example of a |
|
'complex' CORS request is one that uses an HTTP verb other than |
|
GET/HEAD/POST (such as DELETE) or that uses custom headers. To enable |
|
pre-flighting, you must add a new OPTIONS handler for the route you want |
|
to support: |
|
|
|
```javascript |
|
var express = require('express') |
|
var cors = require('cors') |
|
var app = express() |
|
|
|
app.options('/products/:id', cors()) // enable pre-flight request for DELETE request |
|
app.del('/products/:id', cors(), function (req, res, next) { |
|
res.json({msg: 'This is CORS-enabled for all origins!'}) |
|
}) |
|
|
|
app.listen(80, function () { |
|
console.log('CORS-enabled web server listening on port 80') |
|
}) |
|
``` |
|
|
|
You can also enable pre-flight across-the-board like so: |
|
|
|
```javascript |
|
app.options('*', cors()) // include before other routes |
|
``` |
|
|
|
### Configuring CORS Asynchronously |
|
|
|
```javascript |
|
var express = require('express') |
|
var cors = require('cors') |
|
var app = express() |
|
|
|
var whitelist = ['http://example1.com', 'http://example2.com'] |
|
var corsOptionsDelegate = function (req, callback) { |
|
var corsOptions; |
|
if (whitelist.indexOf(req.header('Origin')) !== -1) { |
|
corsOptions = { origin: true } // reflect (enable) the requested origin in the CORS response |
|
} else { |
|
corsOptions = { origin: false } // disable CORS for this request |
|
} |
|
callback(null, corsOptions) // callback expects two parameters: error and options |
|
} |
|
|
|
app.get('/products/:id', cors(corsOptionsDelegate), function (req, res, next) { |
|
res.json({msg: 'This is CORS-enabled for a whitelisted domain.'}) |
|
}) |
|
|
|
app.listen(80, function () { |
|
console.log('CORS-enabled web server listening on port 80') |
|
}) |
|
``` |
|
|
|
## Configuration Options |
|
|
|
* `origin`: Configures the **Access-Control-Allow-Origin** CORS header. Possible values: |
|
- `Boolean` - set `origin` to `true` to reflect the [request origin](http://tools.ietf.org/html/draft-abarth-origin-09), as defined by `req.header('Origin')`, or set it to `false` to disable CORS. |
|
- `String` - set `origin` to a specific origin. For example if you set it to `"http://example.com"` only requests from "http://example.com" will be allowed. |
|
- `RegExp` - set `origin` to a regular expression pattern which will be used to test the request origin. If it's a match, the request origin will be reflected. For example the pattern `/example\.com$/` will reflect any request that is coming from an origin ending with "example.com". |
|
- `Array` - set `origin` to an array of valid origins. Each origin can be a `String` or a `RegExp`. For example `["http://example1.com", /\.example2\.com$/]` will accept any request from "http://example1.com" or from a subdomain of "example2.com". |
|
- `Function` - set `origin` to a function implementing some custom logic. The function takes the request origin as the first parameter and a callback (which expects the signature `err [object], allow [bool]`) as the second. |
|
* `methods`: Configures the **Access-Control-Allow-Methods** CORS header. Expects a comma-delimited string (ex: 'GET,PUT,POST') or an array (ex: `['GET', 'PUT', 'POST']`). |
|
* `allowedHeaders`: Configures the **Access-Control-Allow-Headers** CORS header. Expects a comma-delimited string (ex: 'Content-Type,Authorization') or an array (ex: `['Content-Type', 'Authorization']`). If not specified, defaults to reflecting the headers specified in the request's **Access-Control-Request-Headers** header. |
|
* `exposedHeaders`: Configures the **Access-Control-Expose-Headers** CORS header. Expects a comma-delimited string (ex: 'Content-Range,X-Content-Range') or an array (ex: `['Content-Range', 'X-Content-Range']`). If not specified, no custom headers are exposed. |
|
* `credentials`: Configures the **Access-Control-Allow-Credentials** CORS header. Set to `true` to pass the header, otherwise it is omitted. |
|
* `maxAge`: Configures the **Access-Control-Max-Age** CORS header. Set to an integer to pass the header, otherwise it is omitted. |
|
* `preflightContinue`: Pass the CORS preflight response to the next handler. |
|
* `optionsSuccessStatus`: Provides a status code to use for successful `OPTIONS` requests, since some legacy browsers (IE11, various SmartTVs) choke on `204`. |
|
|
|
The default configuration is the equivalent of: |
|
|
|
```json |
|
{ |
|
"origin": "*", |
|
"methods": "GET,HEAD,PUT,PATCH,POST,DELETE", |
|
"preflightContinue": false, |
|
"optionsSuccessStatus": 204 |
|
} |
|
``` |
|
|
|
For details on the effect of each CORS header, read [this](http://www.html5rocks.com/en/tutorials/cors/) article on HTML5 Rocks. |
|
|
|
## Demo |
|
|
|
A demo that illustrates CORS working (and not working) using jQuery is available here: [http://node-cors-client.herokuapp.com/](http://node-cors-client.herokuapp.com/) |
|
|
|
Code for that demo can be found here: |
|
|
|
* Client: [https://github.com/TroyGoode/node-cors-client](https://github.com/TroyGoode/node-cors-client) |
|
* Server: [https://github.com/TroyGoode/node-cors-server](https://github.com/TroyGoode/node-cors-server) |
|
|
|
## License |
|
|
|
[MIT License](http://www.opensource.org/licenses/mit-license.php) |
|
|
|
## Author |
|
|
|
[Troy Goode](https://github.com/TroyGoode) ([[email protected]](mailto:[email protected])) |
|
|
|
[coveralls-image]: https://img.shields.io/coveralls/expressjs/cors/master.svg |
|
[coveralls-url]: https://coveralls.io/r/expressjs/cors?branch=master |
|
[downloads-image]: https://img.shields.io/npm/dm/cors.svg |
|
[downloads-url]: https://npmjs.org/package/cors |
|
[npm-image]: https://img.shields.io/npm/v/cors.svg |
|
[npm-url]: https://npmjs.org/package/cors |
|
[travis-image]: https://img.shields.io/travis/expressjs/cors/master.svg |
|
[travis-url]: https://travis-ci.org/expressjs/cors |
|
|