# @isomorphic-git/cors-proxy

> Proxy clone and push requests for the browser

Latest version **3.0.3** (published 2026-10-02) · MIT license · 0 weekly downloads

## Install

```sh
npm install @isomorphic-git/cors-proxy
pnpm add @isomorphic-git/cors-proxy
yarn add @isomorphic-git/cors-proxy
bun add @isomorphic-git/cors-proxy
```

Provides the command `cors-proxy`.

## Health

**Score 60/100 (C)** — status: active.

Positive: esm support; no vulnerabilities; recently updated; high maintenance score.

Warnings: low downloads; no types.

## Facts

| | |
|---|---|
| Version | 3.0.3 |
| Published | 2026-10-02 |
| First published | 2018-07-08 |
| Weekly downloads | 0 |
| License | MIT |
| TypeScript types | none |
| Module format | ESM + CommonJS |
| Dependencies | 0 |
| Unpacked size | 18.8 KB |
| Known vulnerabilities | 0 |
| Install scripts | no |
| GitHub stars | 106 |
| Author | William Hilton |
| Maintainers | wmhilton, mojavelinux, jcubic |

## Links

- npm: https://www.npmjs.com/package/@isomorphic-git/cors-proxy
- Repository: https://github.com/isomorphic-git/cors-proxy
- Homepage: https://github.com/isomorphic-git/cors-proxy#readme
- Issues: https://github.com/isomorphic-git/cors-proxy/issues
- npm.io page: https://npm.io/package/@isomorphic-git/cors-proxy

## Recent versions

- 3.0.3 (latest) — 2026-10-02
- 3.0.2 — 2026-06-10
- 3.0.1 — 2026-05-06
- 3.0.0 — 2025-09-25
- 2.7.1 — 2022-01-07
- 2.7.0 — 2020-06-28
- 2.6.1 — 2019-11-22
- 2.6.0 — 2019-11-17
- 2.5.0 — 2019-05-29
- 2.4.0 — 2019-05-28
- 2.3.0 — 2018-12-14
- 2.2.3 — 2018-09-20
- 2.2.2 — 2018-09-11
- 2.2.1 — 2018-09-11
- 2.2.0 — 2018-09-11
- … 1 more at https://npm.io/package/@isomorphic-git/cors-proxy/versions

## README

# @isomorphic-git/cors-proxy

This is the software running on https://cors.isomorphic-git.org/ -
a free service (generously sponsored by [Clever Cloud](https://www.clever-cloud.com/?utm_source=ref&utm_medium=link&utm_campaign=isomorphic-git))
for users of [isomorphic-git](https://isomorphic-git.org) that enables cloning and pushing repos in the browser.

It is derived from https://github.com/wmhilton/cors-buster with added restrictions to reduce the opportunity to abuse the proxy.
Namely, it blocks requests that don't look like valid git requests.

## Installation

```sh
npm install @isomorphic-git/cors-proxy
```

## CLI usage

Start proxy on default port 9999:

```sh
cors-proxy run
```

Start proxy on a custom port:

```sh
cors-proxy run -p 9889
```

Start proxy in daemon mode.

```sh
cors-proxy start
```

Kill the daemon process:

```sh
cors-proxy stop
```

### CLI configuration

Environment variables:

- `PORT` the port to listen to (if run with `npm start`)
- `ALLOW_ORIGIN` the value for the 'Access-Control-Allow-Origin' CORS header
- `INSECURE_HTTP_ORIGINS` comma separated list of origins for which HTTP should be used instead of HTTPS (added to make developing against locally running git servers easier)

## Middleware usage

You can also use the `cors-proxy` as a middleware in your own server.

```js
import express from 'express';
import corsProxy from '@isomorphic-git/cors-proxy';

const app = express();
const options = {};

app.use(corsProxy(options));
```

### Middleware configuration

_The middleware doesn't use the environment variables._ The options object supports the following properties:

- `origin`: _string_. The value for the 'Access-Control-Allow-Origin' CORS header
- `insecure_origins`: _string[]_. Array of origins for which HTTP should be used instead of HTTPS (added to make developing against locally running git servers easier)
- `authorization`: _(req, res, next) => void_. A middleware function you can use to handle custom authorization. Is run after filtering for git-like requests and handling CORS but before the request is proxied.

_Example:_

```ts
app.use(
  corsProxy({
    authorization: (req: Request, res: Response, next: NextFunction) => {
      // proxied git HTTP requests already use the Authorization header for git credentials,
      // so their [Company] credentials are inserted in the X-Authorization header instead.
      if (getAuthorizedUser(req, 'X-Authorization')) {
        return next();
      } else {
        return res.status(401).send("Unable to authenticate you with [Company]'s git proxy");
      }
    },
  }),
);

// Only requests with a valid JSON Web Token will be proxied
function getAuthorizedUser(req: Request, header: string = 'Authorization') {
  const Authorization = req.get(header);

  if (Authorization) {
    const token = Authorization.replace('Bearer ', '');
    try {
      const verifiedToken = verify(token, env.APP_SECRET) as IToken;
      if (verifiedToken) {
        return {
          id: verifiedToken.userId,
        };
      }
    } catch (e) {
      // noop
    }
  }
}
```

## Installation on Kubernetes

There is no official chart for this project, helm or otherwise. You can make your own, but keep in mind cors-proxy uses the Micro server, which will return a 403 error for any requests that do not have the user agent header.

_Example:_

```yaml
containers:
  - name: cors-proxy
    image: node:lts-alpine
    env:
      - name: ALLOW_ORIGIN
        value: https://mydomain.com
    command:
      - npx
    args:
      - '@isomorphic-git/cors-proxy'
      - start
    ports:
      - containerPort: 9999
        hostPort: 9999
        name: proxy
        protocol: TCP
    livenessProbe:
      tcpSocket:
        port: proxy
    readinessProbe:
      tcpSocket:
        port: proxy
```

## License

This work is released under [The MIT License](https://opensource.org/licenses/MIT)

---
_Source: https://npm.io/package/@isomorphic-git/cors-proxy · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._