Norway Porridge Makers


    2.9.0 • Public • Published

    AMP CORS Middleware

    npm version

    The AMP CORS middleware adds CORS and AMP CORS headers to all CORS requests initiated by the AMP runtime. The middleware will only add these headers if the __amp_source_origin query parameter is present. All other requests remain unchanged.


    Install via:

    npm install @ampproject/toolbox-cors --save


    Here is an example using Express:

    const express = require('express');
    const ampCors = require('@ampproject/toolbox-cors');
    const app = express();
    // That's it!

    Please note that AMP CORS does not depend on Express and is based on Node's HTTP Request and Response objects.

    Filtering by source origin

    You can additionally filter requests by source origin. For example:

      sourceOriginPattern: /https:\/\/ampbyexample\.com$/

    This will only allow requests with set as the source origin. Requests from all other origins will receive a 403 response,

    Origin verification

    By default, the AMP CORS middleware will only allow requests from AMP Caches listed on All other origins will receive a 403 response. To allow requests from all origins, disable this via the verifyOrigin option:

      verifyOrigin: false

    Allow Crendentials

    By default, the AMP CORS middleware will allow crendentials mode for AMP CORS requests. To disable this, set allowCredentials to false.

      allowCredentials: false
    // => will not set "Access-Control-Allow-Credentials", "true"

    Allow AMP-Redirect-To

    By default, the AMP CORS middleware will allow redirects via AMP-Redirect-To. To disable this, set enableAmpRedirectTo to false.

      enableAmpRedirectTo: false
    // Access-Control-Expose-Headers: AMP-Redirect-To


    For debugging requests, you can enable the verbose loggin mode via the verbose option:

      verbose: false

    Email Mode

    Gmail has specific AMP CORS requirements. You can enable the Email CORS mode via the email option:

      email: true

    Note: the default AMP CORS mode for websites is compatible with email CORS mode (only origin verification is no longer supported). If you want to support both, it's safe to enable email mode by default.


    See express.js for a sample implementation. There are two scenarios in which the AMP CORS header will be added:

    1. AMP CORS header will be set if the __amp_source_origin query parameter is set together with the AMP-SAME-ORIGIN header:
    $ curl --header "AMP-SAME-ORIGIN: true" -I "http://localhost:3000/items?__amp_source_origin=https://localhost:3000"
    HTTP/1.1 200 OK
    X-Powered-By: Express
    Access-Control-Allow-Origin: https://localhost:3000
    Content-Type: application/json; charset=utf-8
    1. AMP CORS header will be set if the __amp_source_origin query parameter is set together with the Origin header:
    $ curl --header "Origin:" -I "http://localhost:3000/items?__amp_source_origin=https://localhost:3000"
    HTTP/1.1 200 OK
    Content-Type: application/json; charset=utf-8

    In all other cases, no CORS header will be set.

    $ curl -I localhost:3000/items
    HTTP/1.1 200 OK
    Content-Type: application/json; charset=utf-8



    npm i @ampproject/toolbox-cors

    DownloadsWeekly Downloads






    Unpacked Size

    23.1 kB

    Total Files


    Last publish


    • ampproject-admin
    • kristoferbaxter
    • jridgewell
    • choumx
    • amp-toolbox
    • fstanis
    • erwinmombay
    • samouri
    • caroqliu
    • rsimha
    • dvoytenko
    • patrickkettner
    • alanorozco
    • kdwan
    • ampprojectbot
    • esth