[{"data":1,"prerenderedAt":717},["ShallowReactive",2],{"/knowledge-base/cors":3,"/knowledge-base/cors-surround":708},{"id":4,"title":5,"body":6,"category":689,"contentType":690,"date":691,"description":692,"extension":693,"head":694,"image":695,"meta":696,"navigation":411,"ogImage":694,"path":697,"readingTime":698,"robots":694,"schemaOrg":694,"seo":699,"sitemap":700,"stem":701,"tags":702,"__hash__":707},"knowledgeBase/knowledge-base/cors.md","CORS Header Selection Cheatsheet",{"type":7,"value":8,"toc":679},"minimark",[9,13,16,21,86,95,97,101,134,140,142,146,151,177,193,195,199,204,219,224,226,230,256,269,271,275,283,298,322,324,328,627,629,633,672,675],[10,11,12],"p",{},"Use this guide to choose appropriate values for your CORS headers. Adjust settings to balance security and usability based on your API’s needs.",[14,15],"hr",{},[17,18,20],"h2",{"id":19},"_1-access-control-allow-origin","1. Access-Control-Allow-Origin",[22,23,24,45,62],"ul",{},[25,26,27,31,32,36,37],"li",{},[28,29,30],"strong",{},"Specific Domain"," (e.g., ",[33,34,35],"code",{},"https://example.com",")",[22,38,39,42],{},[25,40,41],{},"Restricts access to only trusted sites.",[25,43,44],{},"Use with credentials or sensitive data.",[25,46,47,50],{},[28,48,49],{},"Dynamically Set Origin",[22,51,52,59],{},[25,53,54,55,58],{},"Read the request’s ",[33,56,57],{},"Origin"," header and echo it back when it matches an allow-list.",[25,60,61],{},"Prevents wildcard issues when using cookies or HTTP auth.",[25,63,64,70],{},[28,65,66,67,36],{},"Wildcard (",[33,68,69],{},"*",[22,71,72,75],{},[25,73,74],{},"Allows any site when credentials are NOT involved.",[25,76,77,81,82,85],{},[78,79,80],"em",{},"Do not"," use with ",[33,83,84],{},"Access-Control-Allow-Credentials: true",".",[87,88,89],"warning",{},[10,90,91,92,94],{},"Never combine ",[33,93,69],{}," with credentials—browsers will ignore the wildcard and refuse the request.",[14,96],{},[17,98,100],{"id":99},"_2-access-control-allow-credentials","2. Access-Control-Allow-Credentials",[22,102,103,121],{},[25,104,105,110],{},[28,106,107],{},[33,108,109],{},"true",[22,111,112,115],{},[25,113,114],{},"Enable when your API must accept cookies, HTTP authentication, or client certificates.",[25,116,117,118,85],{},"Must be paired with a non-wildcard ",[33,119,120],{},"Access-Control-Allow-Origin",[25,122,123,129],{},[28,124,125,126],{},"Omit or ",[33,127,128],{},"false",[22,130,131],{},[25,132,133],{},"Safer default if your API is completely public or stateless.",[135,136,137],"tip",{},[10,138,139],{},"Omitting this header prevents browser-side credential leaks by default.",[14,141],{},[17,143,145],{"id":144},"_3-access-control-allow-methods","3. Access-Control-Allow-Methods",[22,147,148],{},[25,149,150],{},"List only the HTTP methods your API actually supports. For example:",[152,153,158],"pre",{"className":154,"code":155,"language":156,"meta":157,"style":157},"language-http shiki shiki-themes github-light github-dark github-dark","Access-Control-Allow-Methods: GET, POST\n","http","",[33,159,160],{"__ignoreMap":157},[161,162,165,169,173],"span",{"class":163,"line":164},"line",1,[161,166,168],{"class":167},"sByVh","Access-Control-Allow-Methods",[161,170,172],{"class":171},"so5gQ",":",[161,174,176],{"class":175},"sfrk1"," GET, POST\n",[22,178,179],{},[25,180,181,182,185,186,185,189,192],{},"Avoid advertising methods you don’t implement (e.g., ",[33,183,184],{},"DELETE",", ",[33,187,188],{},"PUT",[33,190,191],{},"PATCH",") to reduce attack surface.",[14,194],{},[17,196,198],{"id":197},"_4-access-control-allow-headers","4. Access-Control-Allow-Headers",[22,200,201],{},[25,202,203],{},"Specify only the headers your clients need to send. Common examples:",[152,205,207],{"className":154,"code":206,"language":156,"meta":157,"style":157},"Access-Control-Allow-Headers: Content-Type, Authorization, X-Requested-With\n",[33,208,209],{"__ignoreMap":157},[161,210,211,214,216],{"class":163,"line":164},[161,212,213],{"class":167},"Access-Control-Allow-Headers",[161,215,172],{"class":171},[161,217,218],{"class":175}," Content-Type, Authorization, X-Requested-With\n",[22,220,221],{},[25,222,223],{},"Excluding unnecessary headers prevents unexpected or malicious data from being sent.",[14,225],{},[17,227,229],{"id":228},"_5-access-control-max-age","5. Access-Control-Max-Age",[22,231,232,235],{},[25,233,234],{},"Controls how long the browser caches preflight responses (in seconds).",[25,236,237,240],{},[28,238,239],{},"Performance vs. Security:",[22,241,242,249],{},[25,243,244,245,248],{},"Longer cache (e.g., ",[33,246,247],{},"86400"," seconds = 24 hours) reduces preflight overhead.",[25,250,251,252,255],{},"Shorter cache (e.g., ",[33,253,254],{},"600"," seconds) ensures policy changes take effect sooner.",[257,258,259],"info",{},[10,260,261,262,265,266,268],{},"A common compromise is ",[33,263,264],{},"3600"," (1 hour) for dynamic APIs, or ",[33,267,247],{}," (24 hours) for stable endpoints.",[14,270],{},[17,272,274],{"id":273},"_6-access-control-expose-headers","6. Access-Control-Expose-Headers",[22,276,277,280],{},[25,278,279],{},"Use when client-side JavaScript must read custom response headers beyond the CORS-safelisted ones.",[25,281,282],{},"Example:",[152,284,286],{"className":154,"code":285,"language":156,"meta":157,"style":157},"Access-Control-Expose-Headers: X-Total-Count, X-Request-ID\n",[33,287,288],{"__ignoreMap":157},[161,289,290,293,295],{"class":163,"line":164},[161,291,292],{"class":167},"Access-Control-Expose-Headers",[161,294,172],{"class":171},[161,296,297],{"class":175}," X-Total-Count, X-Request-ID\n",[22,299,300],{},[25,301,302,303,185,306,185,309,185,312,185,315,185,318,321],{},"If omitted, browsers only expose simple headers (",[33,304,305],{},"Cache-Control",[33,307,308],{},"Content-Language",[33,310,311],{},"Content-Type",[33,313,314],{},"Expires",[33,316,317],{},"Last-Modified",[33,319,320],{},"Pragma",").",[14,323],{},[17,325,327],{"id":326},"example-configuration-snippet-expressjs","Example Configuration Snippet (Express.js)",[152,329,333],{"className":330,"code":331,"language":332,"meta":157,"style":157},"language-js shiki shiki-themes github-light github-dark github-dark","app.use((req, res, next) => {\n  const allowedOrigins = ['https://app.example.com'];\n  const origin = req.headers.origin;\n\n  if (allowedOrigins.includes(origin)) {\n    res.header('Access-Control-Allow-Origin', origin);\n    res.header('Access-Control-Allow-Credentials', 'true');\n  }\n\n  res.header('Access-Control-Allow-Methods', 'GET,POST');\n  res.header(\n    'Access-Control-Allow-Headers',\n    'Content-Type, Authorization, X-Requested-With'\n  );\n  res.header('Access-Control-Max-Age', '3600');\n  res.header('Access-Control-Expose-Headers', 'X-Total-Count, X-Request-ID');\n\n  if (req.method === 'OPTIONS') {\n    return res.sendStatus(204);\n  }\n  next();\n});\n","js",[33,334,335,371,393,406,413,428,446,466,472,477,497,507,516,522,528,547,566,571,588,607,612,621],{"__ignoreMap":157},[161,336,337,341,345,348,352,354,357,359,362,365,368],{"class":163,"line":164},[161,338,340],{"class":339},"slsVL","app.",[161,342,344],{"class":343},"shcOC","use",[161,346,347],{"class":339},"((",[161,349,351],{"class":350},"sQHwn","req",[161,353,185],{"class":339},[161,355,356],{"class":350},"res",[161,358,185],{"class":339},[161,360,361],{"class":350},"next",[161,363,364],{"class":339},") ",[161,366,367],{"class":171},"=>",[161,369,370],{"class":339}," {\n",[161,372,374,377,381,384,387,390],{"class":163,"line":373},2,[161,375,376],{"class":171},"  const",[161,378,380],{"class":379},"suiK_"," allowedOrigins",[161,382,383],{"class":171}," =",[161,385,386],{"class":339}," [",[161,388,389],{"class":175},"'https://app.example.com'",[161,391,392],{"class":339},"];\n",[161,394,396,398,401,403],{"class":163,"line":395},3,[161,397,376],{"class":171},[161,399,400],{"class":379}," origin",[161,402,383],{"class":171},[161,404,405],{"class":339}," req.headers.origin;\n",[161,407,409],{"class":163,"line":408},4,[161,410,412],{"emptyLinePlaceholder":411},true,"\n",[161,414,416,419,422,425],{"class":163,"line":415},5,[161,417,418],{"class":171},"  if",[161,420,421],{"class":339}," (allowedOrigins.",[161,423,424],{"class":343},"includes",[161,426,427],{"class":339},"(origin)) {\n",[161,429,431,434,437,440,443],{"class":163,"line":430},6,[161,432,433],{"class":339},"    res.",[161,435,436],{"class":343},"header",[161,438,439],{"class":339},"(",[161,441,442],{"class":175},"'Access-Control-Allow-Origin'",[161,444,445],{"class":339},", origin);\n",[161,447,449,451,453,455,458,460,463],{"class":163,"line":448},7,[161,450,433],{"class":339},[161,452,436],{"class":343},[161,454,439],{"class":339},[161,456,457],{"class":175},"'Access-Control-Allow-Credentials'",[161,459,185],{"class":339},[161,461,462],{"class":175},"'true'",[161,464,465],{"class":339},");\n",[161,467,469],{"class":163,"line":468},8,[161,470,471],{"class":339},"  }\n",[161,473,475],{"class":163,"line":474},9,[161,476,412],{"emptyLinePlaceholder":411},[161,478,480,483,485,487,490,492,495],{"class":163,"line":479},10,[161,481,482],{"class":339},"  res.",[161,484,436],{"class":343},[161,486,439],{"class":339},[161,488,489],{"class":175},"'Access-Control-Allow-Methods'",[161,491,185],{"class":339},[161,493,494],{"class":175},"'GET,POST'",[161,496,465],{"class":339},[161,498,500,502,504],{"class":163,"line":499},11,[161,501,482],{"class":339},[161,503,436],{"class":343},[161,505,506],{"class":339},"(\n",[161,508,510,513],{"class":163,"line":509},12,[161,511,512],{"class":175},"    'Access-Control-Allow-Headers'",[161,514,515],{"class":339},",\n",[161,517,519],{"class":163,"line":518},13,[161,520,521],{"class":175},"    'Content-Type, Authorization, X-Requested-With'\n",[161,523,525],{"class":163,"line":524},14,[161,526,527],{"class":339},"  );\n",[161,529,531,533,535,537,540,542,545],{"class":163,"line":530},15,[161,532,482],{"class":339},[161,534,436],{"class":343},[161,536,439],{"class":339},[161,538,539],{"class":175},"'Access-Control-Max-Age'",[161,541,185],{"class":339},[161,543,544],{"class":175},"'3600'",[161,546,465],{"class":339},[161,548,550,552,554,556,559,561,564],{"class":163,"line":549},16,[161,551,482],{"class":339},[161,553,436],{"class":343},[161,555,439],{"class":339},[161,557,558],{"class":175},"'Access-Control-Expose-Headers'",[161,560,185],{"class":339},[161,562,563],{"class":175},"'X-Total-Count, X-Request-ID'",[161,565,465],{"class":339},[161,567,569],{"class":163,"line":568},17,[161,570,412],{"emptyLinePlaceholder":411},[161,572,574,576,579,582,585],{"class":163,"line":573},18,[161,575,418],{"class":171},[161,577,578],{"class":339}," (req.method ",[161,580,581],{"class":171},"===",[161,583,584],{"class":175}," 'OPTIONS'",[161,586,587],{"class":339},") {\n",[161,589,591,594,597,600,602,605],{"class":163,"line":590},19,[161,592,593],{"class":171},"    return",[161,595,596],{"class":339}," res.",[161,598,599],{"class":343},"sendStatus",[161,601,439],{"class":339},[161,603,604],{"class":379},"204",[161,606,465],{"class":339},[161,608,610],{"class":163,"line":609},20,[161,611,471],{"class":339},[161,613,615,618],{"class":163,"line":614},21,[161,616,617],{"class":343},"  next",[161,619,620],{"class":339},"();\n",[161,622,624],{"class":163,"line":623},22,[161,625,626],{"class":339},"});\n",[14,628],{},[17,630,632],{"id":631},"summary","Summary",[22,634,635,644,650,656,666],{},[25,636,637,640,641,643],{},[28,638,639],{},"Origin:"," Prefer specific domains or dynamic allow-lists over ",[33,642,69],{}," when using credentials.",[25,645,646,649],{},[28,647,648],{},"Credentials:"," Only enable if necessary and always pair with a non-wildcard origin.",[25,651,652,655],{},[28,653,654],{},"Methods & Headers:"," Restrict to what your API supports and expects.",[25,657,658,661,662,665],{},[28,659,660],{},"Caching:"," Tune ",[33,663,664],{},"Max-Age"," for your performance/security needs.",[25,667,668,671],{},[28,669,670],{},"Expose:"," Declare any custom headers you need on the client side.",[10,673,674],{},"Keep this cheatsheet handy to ensure your CORS configuration remains secure and efficient!",[676,677,678],"style",{},"html pre.shiki code .sByVh, html code.shiki .sByVh{--shiki-light:#22863A;--shiki-default:#85E89D;--shiki-dark:#85E89D}html pre.shiki code .so5gQ, html code.shiki .so5gQ{--shiki-light:#D73A49;--shiki-default:#F97583;--shiki-dark:#F97583}html pre.shiki code .sfrk1, html code.shiki .sfrk1{--shiki-light:#032F62;--shiki-default:#9ECBFF;--shiki-dark:#9ECBFF}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .slsVL, html code.shiki .slsVL{--shiki-light:#24292E;--shiki-default:#E1E4E8;--shiki-dark:#E1E4E8}html pre.shiki code .shcOC, html code.shiki .shcOC{--shiki-light:#6F42C1;--shiki-default:#B392F0;--shiki-dark:#B392F0}html pre.shiki code .sQHwn, html code.shiki .sQHwn{--shiki-light:#E36209;--shiki-default:#FFAB70;--shiki-dark:#FFAB70}html pre.shiki code .suiK_, html code.shiki .suiK_{--shiki-light:#005CC5;--shiki-default:#79B8FF;--shiki-dark:#79B8FF}",{"title":157,"searchDepth":373,"depth":373,"links":680},[681,682,683,684,685,686,687,688],{"id":19,"depth":373,"text":20},{"id":99,"depth":373,"text":100},{"id":144,"depth":373,"text":145},{"id":197,"depth":373,"text":198},{"id":228,"depth":373,"text":229},{"id":273,"depth":373,"text":274},{"id":326,"depth":373,"text":327},{"id":631,"depth":373,"text":632},"networking","guide","2026-07-15","A quick reference guide for configuring Cross-Origin Resource Sharing (CORS) headers.","md",null,"/knowledge-base/cors.png",{},"/knowledge-base/cors","8",{"title":5,"description":692},{"loc":697},"knowledge-base/cors",[703,704,705,706],"CORS","HTTP","Security","API","rzl1sWnBj8BTwIJneIQjSJt1UTywPmxPwpS-FQSGfMA",[709,713],{"title":710,"path":711,"stem":712,"children":-1},"Useful Bash Aliases","/knowledge-base/bash-aliases","knowledge-base/bash-aliases",{"title":714,"path":715,"stem":716,"children":-1},"Key Concepts in crypto","/knowledge-base/crypto","knowledge-base/crypto",1784306722458]