interface CorsOptions

Options for CORS middleware.

Properties

readonly
optional
enabled: boolean

Enable/disable CORS. Defaults to true when present.

readonly
optional
origin: boolean | string | readonly string[] | CorsOriginMatcher

Origin configuration:

  • true — reflect the request Origin header
  • false — deny all cross-origin
  • string — single allowed origin
  • readonly string[] — allowlist of origins
  • CorsOriginMatcher — dynamic matcher Default: empty allowlist (deny all cross-origin).
readonly
optional
credentials: boolean

When true, emit Access-Control-Allow-Credentials: true.

readonly
optional
methods: readonly string[]

Allowed methods for preflight Allow-Methods header.

readonly
optional
allowedHeaders: readonly string[]

Allowed request headers for the preflight Access-Control-Allow-Headers response.

OMITTED (the default): an allowed origin's preflight ECHOES the request's Access-Control-Request-Headers, and the response carries Vary: Access-Control-Request-Headers.

The previous default was an empty list, which advertised no headers at all while methods defaulted to every standard verb — so the preflight offered POST/PUT/PATCH/DELETE and then refused content-type, the one header a JSON body needs. Every browser blocked every JSON request.

Echoing does not widen the security boundary: the ORIGIN allowlist is what decides, and it is unchanged — a caller that reaches this branch has already been admitted, and the header it is asking for is one it is already sending. Configure a list to deny everything outside it.

readonly
optional
exposedHeaders: readonly string[]

Exposed response headers for Access-Control-Expose-Headers.

readonly
optional
maxAge: number

Max age (seconds) for preflight cache.

Usage

import { type CorsOptions } from "http-security-plugin/src/index.ts";