Nose Picking Mechanisms


    0.0.9 • Public • Published

    Server cors

    Skazka Server Cross-Origin Resource Sharing (CORS).


    How to install

    npm i @skazka/server @skazka/server-cors

    With yarn:

    yarn add @skazka/server @skazka/server-cors

    Optionally you can add http server, error handler, logger, router, request and response:

    npm i @skazka/server-http @skazka/server-router @skazka/server-error @skazka/server-logger @skazka/server-request @skazka/server-response

    With yarn:

    yarn add @skazka/server-http @skazka/server-router @skazka/server-error @skazka/server-logger @skazka/server-request @skazka/server-response

    How to use

    Server module

    const App = require('@skazka/server');
    const Router = require('@skazka/server-router');
    const cors = require('@skazka/server-cors');
    const error = require('@skazka/server-error');
    const logger = require('@skazka/server-logger');
    const request = require('@skazka/server-request');
    const response = require('@skazka/server-response');
    const server = require('@skazka/server-http');
    const app = new App();
    const router = new Router();
    router.get('/data').then(async (ctx) => {
      return ctx.response('data'); 

    Configuring CORS

    const corsOptions = {
      origin: '',
      optionsSuccessStatus: 200 // some legacy browsers (IE11, various SmartTVs) choke on 204
    app.then(cors(corsOptions)); //This is CORS-enabled for only

    If you do not want to block REST tools or server-to-server requests, add a !origin check in the origin function like so:

    var corsOptions = {
      origin(origin, callback) {
        if (whitelist.indexOf(origin) !== -1 || !origin) {
          callback(null, true)
        } else {
          callback(new Error('Not allowed by CORS'))

    Enabling CORS Pre-Flight

    const app = new App();
    router.get('/data').then(async (ctx) => {
      await cors();
      return ctx.response('data'); 

    Configuration Options

    • origin: Configures the Access-Control-Allow-Origin CORS header. Possible values:
      • Boolean - set origin to true to reflect the request origin, as defined by req.header('Origin'), or set it to false to disable CORS.
      • String - set origin to a specific origin. For example if you set it to "" only requests from "" will be allowed.
      • RegExp - set origin to a regular expression pattern which will be used to test the request origin. If it's a match, the request origin will be reflected. For example the pattern /example\.com$/ will reflect any request that is coming from an origin ending with "".
      • Array - set origin to an array of valid origins. Each origin can be a String or a RegExp. For example ["", /\.example2\.com$/] will accept any request from "" or from a subdomain of "".
      • Function - set origin to a function implementing some custom logic. The function takes the request origin as the first parameter and a callback (which expects the signature err [object], allow [bool]) as the second.
    • methods: Configures the Access-Control-Allow-Methods CORS header. Expects a comma-delimited string (ex: 'GET,PUT,POST') or an array (ex: ['GET', 'PUT', 'POST']).
    • allowedHeaders: Configures the Access-Control-Allow-Headers CORS header. Expects a comma-delimited string (ex: 'Content-Type,Authorization') or an array (ex: ['Content-Type', 'Authorization']). If not specified, defaults to reflecting the headers specified in the request's Access-Control-Request-Headers header.
    • exposedHeaders: Configures the Access-Control-Expose-Headers CORS header. Expects a comma-delimited string (ex: 'Content-Range,X-Content-Range') or an array (ex: ['Content-Range', 'X-Content-Range']). If not specified, no custom headers are exposed.
    • credentials: Configures the Access-Control-Allow-Credentials CORS header. Set to true to pass the header, otherwise it is omitted.
    • maxAge: Configures the Access-Control-Max-Age CORS header. Set to an integer to pass the header, otherwise it is omitted.
    • preflightContinue: Pass the CORS preflight response to the next handler.
    • optionsSuccessStatus: Provides a status code to use for successful OPTIONS requests, since some legacy browsers (IE11, various SmartTVs) choke on 204.

    The default configuration is the equivalent of:

      "origin": "*",
      "methods": "GET,HEAD,PUT,PATCH,POST,DELETE",
      "preflightContinue": false,
      "optionsSuccessStatus": 204

    For details on the effect of each CORS header, read this article on HTML5 Rocks.


    npm i @skazka/server-cors

    DownloadsWeekly Downloads






    Unpacked Size

    6.65 kB

    Total Files


    Last publish


    • evheniy.bystrov
    • skazkajs