Express.js · Module

cors

cors is Express/Connect middleware that adds CORS response headers. Use it globally, on individual routes, or with request-dependent options so browsers can evaluate cross-origin access.

How it works

The cors middleware adds CORS response headers. Apply it globally with app.use(cors()), on selected routes with cors(), or provide static or request-dependent options; browsers then use those headers to decide whether client-side JavaScript may read the response.

Syntax

cors(options)

Parameters

Name	Type	Description
`options`	`Object \| Function`	Configuration options, or a function that receives the request and returns CORS options through a callback.

Returns

Middleware function

Key points

The module is Express/Connect middleware that writes the response headers used for cross-origin resource sharing.
The headers communicate which origins may read server responses in browser JavaScript.
Calling cors() with default settings adds a wildcard Access-Control-Allow-Origin header.
A function can replace static options when policy must depend on the incoming request.
Dynamic configuration runs per request and must return its selected options through a callback.
The credentials option controls whether the credentials response header is included.

Common mistakes

CORS headers do not block requests themselves; browser enforcement determines whether JavaScript can read the response.
Testing with curl or Postman does not reproduce browser CORS enforcement.
Complex requests may need an OPTIONS pre-flight request before the actual request.

Example: Enable CORS for one route

const express = require('express');
const cors = require('cors');

const app = express();
app.get('/products/:id', cors(), (req, res) => {
  res.json({ id: req.params.id });
});
app.listen(3000);

Installs CORS headers only for the product route, allowing browsers to read its response.

When to use it

Enable cross-origin API access

An API should be readable by browser clients from permitted origins.

Protect route scope

Only selected endpoints should expose CORS headers.

Dynamic CORS policy

Allowed origins or credentials vary with the incoming request.

Support pre-flight requests

A browser client sends a complex cross-origin request.

Interview questions

QWhat does the cors middleware do?

The middleware sets response headers describing permitted cross-origin access. Browsers inspect those headers and decide whether browser JavaScript can read the response; the middleware does not itself reject the request.

Follow-up: What happens with curl? It can receive the response because non-browser clients do not enforce CORS.

QHow can CORS be scoped in Express?

Use app.use(cors()) to apply it application-wide, or pass cors() as route middleware to limit it to a specific endpoint. The documentation also supports passing configuration options.

Follow-up: How can configuration vary by request? Supply a function that receives the request and returns options through the callback pattern.

QWhat is a CORS pre-flight request?

A complex cross-origin request can begin with an OPTIONS pre-flight request. The route must have an OPTIONS handler when pre-flighting needs to be enabled.

Follow-up: Why may an API still appear accessible from curl? CORS is a browser policy, so curl ignores the headers.

cors
Access-Control-Allow-Origin
Access-Control-Allow-Credentials
OPTIONS
pre-flight request

Source: cors middleware - Express.js. Checked 2026-10-15.