CORS

CORS Middleware

Http-native includes a built-in CORS (Cross-Origin Resource Sharing) middleware.

Basic Usage

import { createApp } from "@http-native/core";
import { cors } from "@http-native/core/cors";

const app = createApp();

// Allow all origins (default)
app.use(cors());

Configuration Options

app.use(cors({
  origin: "https://example.com",
  methods: "GET,POST,PUT,DELETE",
  allowedHeaders: "Content-Type,Authorization",
  credentials: true,
  maxAge: 86400,
}));

Options Reference

Option	Type	Default	Description
origin	string | string[] | boolean	"*"	Allowed origin(s). true reflects the request origin.
methods	string	"GET,HEAD,PUT,PATCH,POST,DELETE"	Allowed HTTP methods
allowedHeaders	string	Reflects request headers	Allowed request headers
credentials	boolean	false	Whether to include Access-Control-Allow-Credentials
maxAge	number	—	Preflight response cache duration in seconds

Examples

Single origin

app.use(cors({
  origin: "https://myapp.com",
  credentials: true,
}));

Multiple origins

app.use(cors({
  origin: ["https://myapp.com", "https://staging.myapp.com"],
}));

Reflect request origin

app.use(cors({
  origin: true,
  credentials: true,
}));

Path-scoped CORS

app.use("/api", cors({
  origin: "https://myapp.com",
  credentials: true,
}));