How to allow CORS with Node.js (without using Express)

Question

I tried answers from other questions and used (updated from https://gist.github.com/balupton/3696140):

var http = require('http');
var cors = require('cors');

http.createServer(app).listen(3000).use();

function app(request, response) {

response.setHeader('Access-Control-Allow-Origin', '*');
response.setHeader('Access-Control-Request-Method', '*');
response.setHeader('Access-Control-Allow-Methods', 'OPTIONS, GET');
response.setHeader('Access-Control-Allow-Headers', '*');

...

}

It returns: http.createServer(...).listen(...).use is not a function

After the update it runs but I am still getting 405 error on the client side.

Correct, use is not a method of server - perhaps this will shed some light - seeing as node cors is middleware for Express (or Connect) - it's not surprising your code won't work as is — Jaromanda X
– Jaromanda X, Commented Jun 7, 2017 at 6:54
still getting the same error I bet ... seeing as you still do http.createServer(app).listen(3000).use(cors()); ... derp — Jaromanda X
– Jaromanda X, Commented Jun 10, 2017 at 5:39
@JaromandaX oh just didn't update here. I am getting 405 error now. — Aero Wang
– Aero Wang, Commented Jun 10, 2017 at 5:42

Black Mamba · Accepted Answer · 2023-10-19 17:13:18Z

53

Here's a detailed answer to add CORS without plugins: The code has been taken from here. Read about CORS Security here.

const http = require('http');
const port = 8080;

http.createServer((req, res) => {
  const headers = {
    'Access-Control-Allow-Origin': '*', /* @dev First, read about security */
    'Access-Control-Allow-Methods': 'OPTIONS, POST, GET',
    'Access-Control-Max-Age': 2592000, // 30 days
    /** add other headers as per requirement */
  };

  if (req.method === 'OPTIONS') {
    res.writeHead(204, headers);
    res.end();
    return;
  }

  if (['GET', 'POST'].indexOf(req.method) > -1) {
    res.writeHead(200, headers);
    res.end('Hello World');
    return;
  }

  res.writeHead(405, headers);
  res.end(`${req.method} is not allowed for the request.`);
}).listen(port);

// You can also set using the following method
res.setHeader('Access-Control-Allow-Origin', '*'); /* @dev First, read about security */
res.setHeader('Access-Control-Allow-Methods', 'OPTIONS, GET');
res.setHeader('Access-Control-Max-Age', 2592000); // 30 days
res.setHeader('Access-Control-Allow-Headers', 'content-type'); // Might be helpful

edited Oct 19, 2023 at 17:13

answered Jan 22, 2019 at 13:08

Black Mamba

15.8k7 gold badges94 silver badges113 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Akseli Arvaja Over a year ago

This didn't work for me until '''res.setHeader('Access-Control-Allow-Headers', req.header.origin);'''according this: gist.github.com/balupton/3696140 '*' is not permitted for the Access-Control-Allow-Headers header.

treejanitor Over a year ago

I also had to add res.setHeader('Access-Control-Allow-Headers', 'content-type'); as well. Some requests seem more tightly controlled.

thejhh · Accepted Answer · 2021-02-17 13:30:57Z

12

No need to pass it to .writeHead(), these days you can use:

response.setHeader('Access-Control-Allow-Origin', '*');
response.setHeader('Access-Control-Allow-Methods', 'OPTIONS, GET');
response.setHeader('Access-Control-Max-Age', 2592000); // 30 days

answered Feb 17, 2021 at 13:30

thejhh

3313 silver badges6 bronze badges

1 Comment

Cong Over a year ago

Add Access-Control-Allow-Headers if necessary: response.setHeader("Access-Control-Allow-Headers", "*");

jony89 · Accepted Answer · 2017-06-07 07:02:39Z

6

You don't want to use Express but yet trying to use it's middle-ware mechanism.

if

var server = http.createServer(app).listen(3000)

then server doesn't have the .use function, the cors module was designed as a middle-ware which means you need to use Express/Connect in order to use it.

You can keep being wihtout expressjs and find different ways than using cors, for e.g see here https://gist.github.com/balupton/3696140

edited Jun 7, 2017 at 7:02

answered Jun 7, 2017 at 6:57

jony89

5,3963 gold badges33 silver badges42 bronze badges

1 Comment

Gabriel Garrett Over a year ago

For those looking everywhere and wondering why their manual solution still isn't working: The linked gist ended up working because it returns the CORS headers on both the preflight response and again on the actual response.

James Wayne · Accepted Answer · 2017-06-10 16:44:04Z

5

This is because you are requesting a not-so-simple request, meaning it needs to handle preflight request which is made as an HTTP OPTIONS request (so be sure your server is able to respond to this method). The preflight request is a way of asking permissions for the actual request, before making the actual request. The server should inspect the two headers above to verify that both the HTTP method and the requested headers are valid and accepted.

answered Jun 10, 2017 at 16:44

James Wayne

1,91214 silver badges14 bronze badges

Collectives™ on Stack Overflow

How to allow CORS with Node.js (without using Express)

4 Answers 4

2 Comments

1 Comment

1 Comment

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

4 Answers 4

2 Comments

1 Comment

1 Comment

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related