CORS Configuration v8.3.0

Configure Cross-Origin Resource Sharing (CORS) for your API endpoints with enhanced options in Novaxjs2 v8.3.0.

Basic Setup

app.cors({
  origins: ['https://example.com'],
  methods: ['GET', 'POST', 'PUT', 'DELETE'],
  headers: ['Content-Type', 'Authorization'],
  credentials: true
});

Allow All Origins

app.cors({
  origins: ['*'],
  methods: ['GET', 'POST', 'PUT', 'DELETE', 'OPTIONS'],
  headers: ['Content-Type', 'Authorization', 'X-Requested-With']
});

Dynamic Origin Validation

app.cors({
  origins: (origin, callback) => {
    // Custom logic to validate origin
    const allowedOrigins = ['https://example.com', 'https://app.example.com'];
    if (allowedOrigins.includes(origin)) {
      callback(null, true);
    } else {
      callback(new Error('Not allowed by CORS'));
    }
  },
  methods: ['GET', 'POST'],
  headers: ['Content-Type']
});

Options

Preflight Request Handling

Novaxjs2 v8.3.0 automatically handles OPTIONS requests for CORS preflight checks. You don't need to define OPTIONS routes manually.

Best Practices