Files
What you'll learn
- Read what a browser sends before a cross-origin request, the OPTIONS preflight, and what cors() answers
- Configure origin, allowMethods, allowHeaders, exposeHeaders, maxAge and credentials, and see each become a header
- Scope CORS to the routes that need it and understand that an origin not on the list simply gets no permission
Press Run tests to start the app. Its log appears here.Graded endpoints
The browser's OPTIONS asks before a GET from https://app.example; cors() answers 204 with the permissions, including the max age it may cache them for
A request that will carry Content-Type and X-Api-Key asks for them; the allowed list is answered
An origin not on the list gets a 204 with no Access-Control-Allow-Origin, which the browser reads as a refusal (the response headers in the panel show the difference)
The actual GET carries the allowed origin back, the credentials flag, and the header the page may read
Same middleware, a second allowed origin
The admin app reads back three cats; the count header follows
DELETE is one of the allowed methods; past CORS, the handler’s 404 still carries the origin header
A 204 with the CORS headers a browser needs to accept it
Tom is gone
cors() is scoped to /api/*: health carries no CORS headers, and needs none