JAVASCRIPT

cors in express

const cors = require('cors');

const corsOption = {
    origin: ['http://localhost:3000'],
};
app.use(cors(corsOption));
//if you want in every domain then
app.use(cors())

express js cors

var express = require('express')
var cors = require('cors')  //use this
var app = express()

app.use(cors()) //and this

app.get('/user/:id', function (req, res, next) {
  res.json({user: 'CORS enabled'})
})

app.listen(5000, function () {
  console.log('CORS-enabled web server listening on port 5000')
})

allow cors express

app.use(function(req, res, next) {
  res.header("Access-Control-Allow-Origin", "YOUR-DOMAIN.TLD"); // update to match the domain you will make the request from
  res.header("Access-Control-Allow-Headers", "Origin, X-Requested-With, Content-Type, Accept");
  next();
});

cors express tutorial

$ npm install cors


const cors = require('cors');

const corsOption = {
    origin: ['http://localhost:3000'],
};
app.use(cors(corsOption));

express cors specific origins

let allowedOrigins = ['http://localhost:8080', 'http://testsite.com'];

app.use(cors({
  origin: (origin, callback) => {
    if(!origin) return callback(null, true);
    if(allowedOrigins.indexOf(origin) === -1){ // If a specific origin isn’t found on the list of allowed origins
      let message = 'The CORS policy for this application doesn’t allow access from origin ' + origin;
      return callback(new Error(message ), false);
    }
    return callback(null, true);
  }
}));

express js cors

//Cors = Cross-origin resource sharing

var express = require('express');
var cors = require('cors');
var app = express();

app.use(cors());

var corsOptions = {
  origin: 'http://example.com',
  optionsSuccessStatus: 200 // some legacy browsers (IE11, various SmartTVs) choke on 204
}

app.listen(80, function () {
  console.log('CORS-enabled web server listening on port 80')
})

best cors options for express app

// In Nginx
map $http_origin $allow_origin {
    ~^https?://(.*.)?my-domain.com(:d+)?$ $http_origin;
    ~^https?://(.*.)?localhost(:d+)?$ $http_origin;
    default "";
}

server {
    listen 80 default_server;
    server_name _;
    add_header 'Access-Control-Allow-Origin' $allow_origin;
    # ...
}