@koa/cors

[![NPM version][npm-image]][npm-url]
[![Test coverage][codecov-image]][codecov-url]
[![npm download][download-image]][download-url]

[npm-image]: https://img.shields.io/npm/v/@koa/cors.svg?style=flat-square
[npm-url]: https://npmjs.org/package/@koa/cors
[codecov-image]: https://codecov.io/github/koajs/cors/coverage.svg?branch=v2.x
[codecov-url]: https://codecov.io/github/koajs/cors?branch=v2.x
[download-image]: https://img.shields.io/npm/dm/@koa/cors.svg?style=flat-square
[download-url]: https://npmjs.org/package/@koa/cors

Cross-Origin Resource Sharing(CORS) for koa

Installation

``bash
$ npm install @koa/cors --save
`

Quick start

Enable cors with default options:

- origin: request Origin header
- allowMethods: GET,HEAD,PUT,POST,DELETE,PATCH

`js
const Koa = require('koa');
const cors = require('@koa/cors');

const app = new Koa();
app.use(cors());
`

cors(options)

`js
/**
* CORS middleware
*
* @param {Object} [options]
- {String|Function(ctx)} origin Access-Control-Allow-Origin, default is ''
* If credentials set and return true, the origin default value will set to the request Origin header
* - {String|Array} allowMethods Access-Control-Allow-Methods, default is 'GET,HEAD,PUT,POST,DELETE,PATCH'
* - {String|Array} exposeHeaders Access-Control-Expose-Headers
* - {String|Array} allowHeaders Access-Control-Allow-Headers
* - {String|Number} maxAge Access-Control-Max-Age in seconds
* - {Boolean|Function(ctx)} credentials Access-Control-Allow-Credentials, default is false.
* - {Boolean} keepHeadersOnError Add set headers to err.header if an error is thrown
* - {Boolean} secureContext Cross-Origin-Opener-Policy & Cross-Origin-Embedder-Policy headers.', default is false
* - {Boolean} privateNetworkAccess handle Access-Control-Request-Private-Network request by return Access-Control-Allow-Private-Network, default to false
* @return {Function} cors middleware
* @api public
*/
``

Breaking change between 5.0 and 4.0

The default origin is set to *, if you want to keep the 4.0 behavior, you can set the origin handler like this:

`js
app.use(cors({
origin(ctx) {
return ctx.get('Origin') || '*';
},
}));
`

License

MIT

Contributors

|
fengmk2
|
dead-horse
|
omsmith
|
jonathanong
|
AlphaWong
|
cma-skedulo
|
| :---: | :---: | :---: | :---: | :---: | :---: |
|
CleberRossi
|
erikfried
|
j-waaang
|
ltomes
|
lfreneda
|
matthewmueller
|

PlasmaPower
|
swain
|
TyrealHu
|
xg-wang
|
lishengzxc
|
mcohen75


This project follows the git-contributor spec, auto updated at Sat Oct 08 2022 21:35:10 GMT+0800`.