CORS

Cross-Origin Resource Sharing — controlled cross-origin requests.

SecuritySimple

Stack Components

HeaderAccess-Control-*

Why

Standardized cross-origin access, preflight for safety, credential support. Verizon DBIR 2024: 68% of breaches involve human error.

Snyk and Dependabot scan 500k+ npm packages for CVEs, and OWASP Top 10 hasn't changed much — injection and broken auth remain #1 and #2.

When

Use for APIs accessed by browsers. Avoid for same-origin apps.

How

1. Configure Access-Control-Allow-Origin 2. Set allowed methods 3. Set allowed headers 4. Handle preflight OPTIONS

Example

Access-Control-Allow-Origin: https://example.com Access-Control-Allow-Methods: GET, POST Access-Control-Allow-Headers: Content-Type // CORS — usage example import { CORS } from "sec2-cors"; const result = await cors({ input: "data" }); console.log(result);

Common Problems

⚠Wildcard with credentials — not allowed, specify origin
⚠Preflight caching — set Access-Control-Max-Age
⚠Configuration drift between environments — use infrastructure-as-code (Terraform/Pulumi) to keep dev/staging/prod identical

Best Practices

✓Whitelist specific origins
✓Use cors middleware for Express
✓Set up health checks and graceful shutdown — handle SIGTERM to drain in-flight requests before exit

FAQ

What is CORS and what projects is it for?

Cross-Origin Resource Sharing — controlled cross-origin requests. It pairs layered technologies for end-to-end type safety and out-of-the-box deploys, fitting everything from MVPs to production SaaS.

How do I spin up a working demo with CORS in 10 minutes?

Two steps: (1) Configure Access-Control-Allow-Origin; (2) Set allowed methods. Get the local dev server running, then wire one real data source to verify the end-to-end loop.

What is the most common pitfall with CORS and how do I avoid it?

The most common pitfall is: Wildcard with credentials — not allowed, specify origin. Avoid it by adding the matching checklist to your PR template and running type-check + lint + unit tests in CI — three gates before merge.

What are the best practices for CORS?

Best practices for CORS include: Whitelist specific origins; Use cors middleware for Express; Set up health checks and graceful shutdown — handle SIGTERM to drain in-flight requests before exit. The first one — "Whitelist specific origins" — should be set up at project init to avoid costly rework later.

When should I NOT choose CORS?

Pick something else in three cases: (1) the team has zero experience with the core framework and the deadline is tight (learning-curve risk); (2) it's a pure content/marketing site (Astro is lighter); (3) you need very high throughput (>10k RPS) or strict-consistency microservices (Go/Rust). CORS shines for mid-to-high complexity full-stack and API work — don't over-engineer simple static pages with it.