expressjs / expressjs/cors

Add support for having specified domain instead of wildcard

Open
#310 4 comments 0 reactions 0 assignees View on GitHub
Dominant language
JavaScript
Stars
6.2k
Forks
512
PR merge metrics
No merged PRs in 30d

Description

**What**
We have a use case where we want to allow all domains `*` as origin, but we want library to set exact domain value (req.headers.origin) instead of `*` in `Access-Control-Allow-Origin` header.

The use-case comes as we also need to send credentials such as Cookies to the server. And, with `*` as `Access-Control-Allow-Origin`, you can't send credentials to the server.

It can be done by adding another option such as `exactOriginIfMatches: true`:
```
var corsOptions = {
origin: '*',
exactOriginIfMatches: true,
}
```

**Current Behaviour***
```
var corsOptions = {
origin: '*',
};

Request comes from http://example.com -> Library sets `Access-Control-Allow-Origin: *`

```

**Proposed Behaviour***
```
var corsOptions = {
origin: '*',
exactOriginIfMatches: true,
};

Request comes from http://example.com -> Library sets `Access-Control-Allow-Origin: http://example.com`

var corsOptions = {
origin: '*',
exactOriginIfMatches: false,
};

Request comes from http://example.com -> Library sets `Access-Control-Allow-Origin: *`
```

In that case, the behaviour will be same but the value of `Access-Control-Allow-Origin` will be `req.headers.origin` instead of `*`. It will be helpful in sending credentials to the server.

Let me know how does it sound? Will be happy to open a PR if that makes sense!

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.