Documentation

Documentation / zerotal / index / CorsOptions

Interface: CorsOptions

Defined in: packages/core/src/middleware/CorsMiddleware.ts:11

Properties

origin?

optional origin?: string | string[] | ((origin) => boolean)

Defined in: packages/core/src/middleware/CorsMiddleware.ts:29

Allowed origins. Default: [] — same-origin only, so nothing is shared until an app names what it means to share with.

A string or array is matched exactly against the request's Origin, scheme and port included.

'*' allows any origin. It cannot be combined with credentials: true (the browser rejects that pairing outright), and it means every page on the internet can read any response this middleware covers that is not separately credential-gated.

A function receives the raw Origin header and returns whether to allow it. Match the whole origin, not a suffix: o.endsWith('.example.com') also matches https://evil.example.com.attacker.test and http://x.example.com — write new URL(o).hostname.endsWith('.example.com') && o.startsWith('https://'), or just list the origins.

methods?

optional methods?: string[]

Defined in: packages/core/src/middleware/CorsMiddleware.ts:31

Allowed HTTP methods. Default: ['GET','POST','PUT','PATCH','DELETE','OPTIONS'].

allowedHeaders?

optional allowedHeaders?: string[]

Defined in: packages/core/src/middleware/CorsMiddleware.ts:33

Allowed request headers. Default: ['Content-Type','Authorization','X-Requested-With'].

exposedHeaders?

optional exposedHeaders?: string[]

Defined in: packages/core/src/middleware/CorsMiddleware.ts:35

Headers the browser may expose to JS. Default: [].

credentials?

optional credentials?: boolean

Defined in: packages/core/src/middleware/CorsMiddleware.ts:37

Allow cookies / auth headers in cross-origin requests. Default: false.

maxAge?

optional maxAge?: number

Defined in: packages/core/src/middleware/CorsMiddleware.ts:39

Preflight cache duration in seconds. Default: 600.