Nrthugu

I found the easiest way is to use the node.js package cors. The simplest usage is:

var cors = require('cors')



var app = express()

app.use(cors())

There are, of course many ways to configure the behaviour to your needs; the page linked above shows a number of examples.

Try passing control to the next matching route. If Express is matching app.get route first, then it won't continue onto the options route unless you do this (note use of next):

app.get('somethingelse', function(req, res, next) {

    //..set headers etc.



    next();

});

In terms of organising the CORS stuff, I put it in a middleware which is working well for me:

//CORS middleware

var allowCrossDomain = function(req, res, next) {

    res.header('Access-Control-Allow-Origin', 'example.com');

    res.header('Access-Control-Allow-Methods', 'GET,PUT,POST,DELETE');

    res.header('Access-Control-Allow-Headers', 'Content-Type');



    next();

}



//...

app.configure(function() {

    app.use(express.bodyParser());

    app.use(express.cookieParser());

    app.use(express.session({ secret: 'cool beans' }));

    app.use(express.methodOverride());

    app.use(allowCrossDomain);

    app.use(app.router);

    app.use(express.static(__dirname + '/public'));

});

To stay in the same idea of routing. I use this code :

app.all('/*', function(req, res, next) {

  res.header("Access-Control-Allow-Origin", "*");

  res.header("Access-Control-Allow-Headers", "X-Requested-With");

  next();

});

Similar to http://enable-cors.org/server_expressjs.html example

do

npm install cors --save

and just add these lines in your main file where your request going (keep it before any route).

const cors = require('cors');

const express = require('express');

let app = express();

app.use(cors());

app.options('*', cors());

I have made a more complete middleware suitable for express or connect. It supports OPTIONS requests for preflight checking. Note that it will allow CORS access to anything, you might want to put in some checks if you want to limit access.

app.use(function(req, res, next) {

    var oneof = false;

    if(req.headers.origin) {

        res.header('Access-Control-Allow-Origin', req.headers.origin);

        oneof = true;

    }

    if(req.headers['access-control-request-method']) {

        res.header('Access-Control-Allow-Methods', req.headers['access-control-request-method']);

        oneof = true;

    }

    if(req.headers['access-control-request-headers']) {

        res.header('Access-Control-Allow-Headers', req.headers['access-control-request-headers']);

        oneof = true;

    }

    if(oneof) {

        res.header('Access-Control-Max-Age', 60 * 60 * 24 * 365);

    }



    // intercept OPTIONS method

    if (oneof && req.method == 'OPTIONS') {

        res.send(200);

    }

    else {

        next();

    }

});

install cors module of expressjs. you can follow these steps >

Installation

npm install cors

Simple Usage (Enable All CORS Requests)

var express = require('express');

var cors = require('cors');

var app = express();

app.use(cors());

for more details go to https://github.com/expressjs/cors

Do something like this:

app.use(function(req, res, next) {

    res.header("Access-Control-Allow-Origin", "*");

    res.header("Access-Control-Allow-Headers", "Origin, X-Requested-With, Content-Type, Accept");

    next();

});

Testing done with express + node + ionic running in differente ports.

Localhost:8100

Localhost:5000

// CORS (Cross-Origin Resource Sharing) headers to support Cross-site HTTP requests



app.all('*', function(req, res, next) {

       res.header("Access-Control-Allow-Origin", "*");

       res.header("Access-Control-Allow-Headers", "X-Requested-With");

       res.header('Access-Control-Allow-Headers', 'Content-Type');

       next();

});

first simply install cors in your project.
Take terminal(command prompt) and cd to your project directory and run the below command:

npm install cors --save

Then take the server.js file and change the code to add the following in it:

var cors = require('cors');





var app = express();



app.use(cors());



app.use(function(req, res, next) {

   res.header("Access-Control-Allow-Origin", "*");

   res.header('Access-Control-Allow-Methods', 'DELETE, PUT, GET, POST');

   res.header("Access-Control-Allow-Headers", "Origin, X-Requested-With, Content-Type, Accept");

   next();

});

This worked for me..

This works for me, as its an easy implementation inside the routes, im using meanjs and its working fine, safari, chrome, etc.

app.route('/footer-contact-form').post(emailer.sendFooterMail).options(function(req,res,next){ 

        res.header('Access-Control-Allow-Origin', '*'); 

        res.header('Access-Control-Allow-Methods', 'GET, POST');

        res.header('Access-Control-Allow-Headers', 'Origin, X-Requested-With, Content-Type, Accept');

        return res.send(200);



    });

Some time ago, I faced this problem so I did this to allow CORS in my nodejs app:

First you need to install cors by using below command :

npm install cors --save

Now add the following code to your app starting file like ( app.js or server.js)

var express = require('express');

var app = express();



var cors = require('cors');

var bodyParser = require('body-parser');



//enables cors

app.use(cors({

  'allowedHeaders': ['sessionId', 'Content-Type'],

  'exposedHeaders': ['sessionId'],

  'origin': '*',

  'methods': 'GET,HEAD,PUT,PATCH,POST,DELETE',

  'preflightContinue': false

}));



require('./router/index')(app);

If you want to make it controller specific, you can use:

res.setHeader('X-Frame-Options', 'ALLOWALL');

res.setHeader('Access-Control-Allow-Origin', '*');

res.setHeader('Access-Control-Allow-Methods', 'POST, GET');

res.setHeader('Access-Control-Allow-Headers', 'Origin, X-Requested-With, Content-Type, Accept');

Please note that this will also allow iframes.

Can refer the code below for the same. Source: Academind/node-restful-api

const express = require('express');

const app = express();



//acts as a middleware

//to handle CORS Errors

app.use((req, res, next) => { //doesn't send response just adjusts it

    res.header("Access-Control-Allow-Origin", "*") //* to give access to any origin

    res.header(

        "Access-Control-Allow-Headers",

        "Origin, X-Requested-With, Content-Type, Accept, Authorization" //to give access to all the headers provided

    );

    if(req.method === 'OPTIONS'){

        res.header('Access-Control-Allow-Methods', 'PUT, POST, PATCH, DELETE, GET'); //to give access to all the methods provided

        return res.status(200).json({});

    }

    next(); //so that other routes can take over

})

My simplest solution with Express 4.2.0 (EDIT: Doesn't seem to work in 4.3.0) was:

function supportCrossOriginScript(req, res, next) {

    res.status(200);

    res.header("Access-Control-Allow-Origin", "*");

    res.header("Access-Control-Allow-Headers", "Content-Type");



    // res.header("Access-Control-Allow-Headers", "Origin");

    // res.header("Access-Control-Allow-Headers", "Origin, X-Requested-With, Content-Type, Accept");

    // res.header("Access-Control-Allow-Methods","POST, OPTIONS");

    // res.header("Access-Control-Allow-Methods","POST, GET, OPTIONS, DELETE, PUT, HEAD");

    // res.header("Access-Control-Max-Age","1728000");

    next();

}



// Support CORS

app.options('/result', supportCrossOriginScript);



app.post('/result', supportCrossOriginScript, function(req, res) {

    res.send('received');

    // do stuff with req

});

I suppose doing app.all('/result', ...) would work too...

In addition to what others have said, don't forget that unless using nodemon you will need to restart your node server for the changes to take effect!

I personally had been refreshing my browser out of habit, forgetting that it's server side code.

I found it to be extremely easy to do this with the npm request package (https://www.npmjs.com/package/request)

Then I based my solution on this post http://blog.javascripting.com/2015/01/17/dont-hassle-with-cors/

'use strict'



const express = require('express');

const request = require('request');



let proxyConfig = {

    url : {

        base: 'http://servertoreach.com?id=',

    }

}



/* setting up and configuring node express server for the application */

let server = express();

server.set('port', 3000);





/* methods forwarded to the servertoreach proxy  */

server.use('/somethingElse', function(req, res)

{

    let url = proxyConfig.url.base + req.query.id;

    req.pipe(request(url)).pipe(res);

});





/* start the server */

server.listen(server.get('port'), function() {

    console.log('express server with a proxy listening on port ' + server.get('port'));

});

Using Express Middleware works great for me. If you are already using Express, just add the following middleware rules. It should start working.

app.all("/api/*", function(req, res, next) {

  res.header("Access-Control-Allow-Origin", "*");

  res.header("Access-Control-Allow-Headers", "Cache-Control, Pragma, Origin, Authorization, Content-Type, X-Requested-With");

  res.header("Access-Control-Allow-Methods", "GET, PUT, POST");

  return next();

});



app.all("/api/*", function(req, res, next) {

  if (req.method.toLowerCase() !== "options") {

    return next();

  }

  return res.send(204);

});

Reference

We can avoid CORS and forward the requests to the other server instead:

// config:

var public_folder = __dirname + '/public'

var apiServerHost = 'http://other.server'



// code:

console.log("starting server...");



var express = require('express');

var app = express();

var request = require('request');



// serve static files

app.use(express.static(public_folder));



// if not found, serve from another server

app.use(function(req, res) {

    var url = apiServerHost + req.url;

    req.pipe(request(url)).pipe(res);

});



app.listen(80, function(){

    console.log("server ready");

});

I used the following steps to my web app and I had success:

Add the cors package to the express:

npm install cors --save

Add following lines after the bodyParser configuration. I had some troubles adding before bodyParser:

 // enable cors to the server

const corsOpt = {

    origin: process.env.CORS_ALLOW_ORIGIN || '*', // this work well to configure origin url in the server

    methods: ['GET', 'PUT', 'POST', 'DELETE', 'OPTIONS'], // to works well with web app, OPTIONS is required

    allowedHeaders: ['Content-Type', 'Authorization'] // allow json and token in the headers

};

app.use(cors(corsOpt)); // cors for all the routes of the application

app.options('*', cors(corsOpt)); // automatic cors gen for HTTP verbs in all routes, This can be redundant but I kept to be sure that will always work.

This is similiar to Pat's answer with the difference that I finish with res.sendStatus(200); instead of next();

The code will catch all the requests of the method type OPTIONS and send back access-control-headers.

app.options('/*', (req, res, next) => {

    res.header('Access-Control-Allow-Origin', '*');

    res.header('Access-Control-Allow-Methods', 'GET,PUT,POST,DELETE,OPTIONS');

    res.header('Access-Control-Allow-Headers', 'Content-Type, Authorization, Content-Length, X-Requested-With');

    res.sendStatus(200);

});

The code accepts CORS from all origins as requested in the question. However, it would be better to replace the * with a specific origin i.e. http://localhost:8080 to prevent misuse.

Since we use the app.options-method instead of the app.use-method we don't need to make this check:

req.method === 'OPTIONS'

which we can see in some of the other answers.

I found the answer here: http://johnzhang.io/options-request-in-express.

In typescript, if you want to use the node.js package cors

/**

* app.ts

* If you use the cors library

*/



import * as express from "express";

[...]

import * as cors from 'cors';



class App {

   public express: express.Application;



   constructor() {

       this.express = express();

       [..]

       this.handleCORSErrors();

   }



   private handleCORSErrors(): any {

       const corsOptions: cors.CorsOptions = {

           origin: 'http://example.com',

           optionsSuccessStatus: 200

       };

       this.express.use(cors(corsOptions));

   }

}



export default new App().express;

If you don't want to use third part libraries for cors error handling, you need to change the handleCORSErrors() method.

/**

* app.ts

* If you do not use the cors library

*/



import * as express from "express";

[...]



class App {

   public express: express.Application;



   constructor() {

       this.express = express();

       [..]

       this.handleCORSErrors();

   }



   private handleCORSErrors(): any {

       this.express.use((req, res, next) => {

           res.header("Access-Control-Allow-Origin", "*");

           res.header(

               "Access-Control-ALlow-Headers",

               "Origin, X-Requested-With, Content-Type, Accept, Authorization"

           );

           if (req.method === "OPTIONS") {

               res.header(

                   "Access-Control-Allow-Methods",

                   "PUT, POST, PATCH, GET, DELETE"

               );

               return res.status(200).json({});

           } 

           next(); // send the request to the next middleware

       });

    }

}



export default new App().express;

For using the app.ts file

/**

* server.ts

*/

import * as http from "http";

import app from "./app";



const server: http.Server = http.createServer(app);



const PORT: any = process.env.PORT || 3000;

server.listen(PORT);

Below code will work ,but first install cors by:

npm install --save cors

Then:

module.exports = function(app) { 

var express = require("express");

var cors = require('cors');

var router = express.Router();

app.use(cors());



app.post("/movies",cors(), function(req, res) { 

res.send("test");

});