CORS in Node.js and Express: A TypeScript Implementation

#node #express #typescript #cors

Fix CORS in Express Without Allowing Every Origin

The Express corsmiddleware manages the response headers browsers need for cross-origin requests. A production-ready setup should use an explicit origin allowlist, handle preflight requests, and configure credentials only when required.

1. Install

npm install express cors
npm install -D @types/express @types/cors

2. Create a reusable middleware

import cors, { type CorsOptions } from 'cors';

const allowedOrigins = new Set([
  'http://localhost:4200',
  'https://app.example.com',
]);

const options: CorsOptions = {
  origin(origin, callback) {
    callback(
      null,
      !origin ? false : allowedOrigins.has(origin) ? origin : false,
    );
  },
  methods: ['GET', 'POST', 'PUT', 'PATCH', 'DELETE'],
  allowedHeaders: ['Content-Type', 'Authorization'],
  maxAge: 600,
};

export const corsMiddleware = cors(options);

3. Register it before routes

import express from 'express';
import { corsMiddleware } from './cors.middleware.js';

const app = express();

app.use(corsMiddleware);
app.use(express.json());

app.get('/api/products', (_req, res) => {
  res.json([{ id: 1, name: 'Keyboard' }]);
});

app.listen(3000);

Application-level middleware handles preflight requests automatically.

4. What about cookies?

For cookie-based authentication, use a specific trusted origin and enable credentials:

const options: CorsOptions = {
  origin: ['https://app.example.com'],
  credentials: true,
};

On the frontend:

fetch('https://api.example.com/api/profile', {
  credentials: 'include',
});

Remember: credentialed CORS requests cannot use Access-Control-Allow-Origin: *. Cookie settings and CSRF protection still matter.

Key takeaways

Keep CORS configuration in one reusable middleware.
Allow known frontend origins instead of reflecting arbitrary origins.
Let application-level CORS middleware handle preflight requests.
Treat CORS and API authentication as separate security concerns.

I wrote about this in much more detail on Medium if you want to dive deeper: https://medium.com/@vetriselvan_11/cors-in-node-js-and-express-a-typescript-implementation-ff259e2bb884?sharedUserId=vetriselvan_11

A question for backend developers: Do you configure CORS globally in Express, or do you prefer separate policies for public APIs, admin routes, and authentication endpoints?