# @koa/cors > Cross-Origin Resource Sharing(CORS) for koa Latest version **5.0.0** (published 2023-12-11) · MIT license · 0 weekly downloads ## Install ```sh npm install @koa/cors pnpm add @koa/cors yarn add @koa/cors bun add @koa/cors ``` ## Health **Score 23/100 (F)** — status: abandoned. Positive: has types package; no vulnerabilities; high quality score. Warnings: low downloads; no esm support. Negative: abandoned; low maintenance score. ## Facts | | | |---|---| | Version | 5.0.0 | | Published | 2023-12-11 | | First published | 2017-09-30 | | Weekly downloads | 0 | | License | MIT | | TypeScript types | separate (@types/koa__cors) | | Module format | CommonJS | | Node | >= 14.0.0 | | Dependencies | 1 | | Unpacked size | 12.9 KB | | Known vulnerabilities | 0 | | Install scripts | no | | GitHub stars | 742 | | Author | fengmk2 | | Maintainers | ljharb, 3imed-jaberi, titanism, niftylettuce, fengmk2, dead_horse, jongleberry, juliangruber, aaron | | Keywords | cors, koa-cors, Cross-Origin Resource Sharing, @koa/cors, koa, koajs | ## Links - npm: https://www.npmjs.com/package/@koa/cors - Repository: https://github.com/koajs/cors - Issues: https://github.com/koajs/cors/issues - npm.io page: https://npm.io/package/@koa/cors ## Dependencies (1) - [vary](https://npm.io/package/vary.md) ^1.1.2 ## Alternatives - [jsforce](https://npm.io/package/jsforce.md) — 851.2K weekly downloads - [react-native-qrcode-svg](https://npm.io/package/react-native-qrcode-svg.md) — 693.5K weekly downloads - [@salesforce/plugin-data](https://npm.io/package/@salesforce/plugin-data.md) — 394.9K weekly downloads - [@backstage/plugin-search-common](https://npm.io/package/@backstage/plugin-search-common.md) — 308.5K weekly downloads - [@chain-registry/types](https://npm.io/package/@chain-registry/types.md) — 38.4K weekly downloads ## Recent versions - 5.0.0 (latest) — 2023-12-11 - 3.4.3 (latest-3) — 2022-10-08 - 4.0.0 — 2022-10-08 - 3.4.2 — 2022-10-05 - 3.4.1 — 2022-08-19 - 3.4.0 — 2022-08-19 - 3.3.0 — 2022-03-29 - 3.2.0 — 2022-03-12 - 3.1.0 — 2020-05-17 - 3.0.0 — 2019-03-11 - 2.2.3 — 2018-12-19 - 2.2.2 — 2018-07-11 - 2.2.1 — 2017-09-30 ## README # @koa/cors [![NPM version][npm-image]][npm-url] [![Node.js CI](https://github.com/koajs/cors/actions/workflows/nodejs.yml/badge.svg)](https://github.com/koajs/cors/actions/workflows/nodejs.yml) [![Test coverage][codecov-image]][codecov-url] [![npm download][download-image]][download-url] [npm-image]: https://img.shields.io/npm/v/@koa/cors.svg?style=flat-square [npm-url]: https://npmjs.org/package/@koa/cors [codecov-image]: https://codecov.io/github/koajs/cors/coverage.svg?branch=v2.x [codecov-url]: https://codecov.io/github/koajs/cors?branch=v2.x [download-image]: https://img.shields.io/npm/dm/@koa/cors.svg?style=flat-square [download-url]: https://npmjs.org/package/@koa/cors [Cross-Origin Resource Sharing(CORS)](https://developer.mozilla.org/en/docs/Web/HTTP/Access_control_CORS) for koa ## Installation ```bash $ npm install @koa/cors --save ``` ## Quick start Enable cors with default options: - origin: request Origin header - allowMethods: GET,HEAD,PUT,POST,DELETE,PATCH ```js const Koa = require('koa'); const cors = require('@koa/cors'); const app = new Koa(); app.use(cors()); ``` ## cors(options) ```js /** * CORS middleware * * @param {Object} [options] * - {String|Function(ctx)} origin `Access-Control-Allow-Origin`, default is '*' * If `credentials` set and return `true, the `origin` default value will set to the request `Origin` header * - {String|Array} allowMethods `Access-Control-Allow-Methods`, default is 'GET,HEAD,PUT,POST,DELETE,PATCH' * - {String|Array} exposeHeaders `Access-Control-Expose-Headers` * - {String|Array} allowHeaders `Access-Control-Allow-Headers` * - {String|Number} maxAge `Access-Control-Max-Age` in seconds * - {Boolean|Function(ctx)} credentials `Access-Control-Allow-Credentials`, default is false. * - {Boolean} keepHeadersOnError Add set headers to `err.header` if an error is thrown * - {Boolean} secureContext `Cross-Origin-Opener-Policy` & `Cross-Origin-Embedder-Policy` headers.', default is false * - {Boolean} privateNetworkAccess handle `Access-Control-Request-Private-Network` request by return `Access-Control-Allow-Private-Network`, default to false * @return {Function} cors middleware * @api public */ ``` ## Breaking change between 5.0 and 4.0 The default `origin` is set to `*`, if you want to keep the 4.0 behavior, you can set the `origin` handler like this: ```js app.use(cors({ origin(ctx) { return ctx.get('Origin') || '*'; }, })); ``` ## License [MIT](./LICENSE) ## Contributors |[
fengmk2](https://github.com/fengmk2)
|[
dead-horse](https://github.com/dead-horse)
|[
omsmith](https://github.com/omsmith)
|[
jonathanong](https://github.com/jonathanong)
|[
AlphaWong](https://github.com/AlphaWong)
|[
cma-skedulo](https://github.com/cma-skedulo)
| | :---: | :---: | :---: | :---: | :---: | :---: | |[
CleberRossi](https://github.com/CleberRossi)
|[
erikfried](https://github.com/erikfried)
|[
j-waaang](https://github.com/j-waaang)
|[
ltomes](https://github.com/ltomes)
|[
lfreneda](https://github.com/lfreneda)
|[
matthewmueller](https://github.com/matthewmueller)
| [
PlasmaPower](https://github.com/PlasmaPower)
|[
swain](https://github.com/swain)
|[
TyrealHu](https://github.com/TyrealHu)
|[
xg-wang](https://github.com/xg-wang)
|[
lishengzxc](https://github.com/lishengzxc)
|[
mcohen75](https://github.com/mcohen75)
This project follows the git-contributor [spec](https://github.com/xudafeng/git-contributor), auto updated at `Sat Oct 08 2022 21:35:10 GMT+0800`. --- _Source: https://npm.io/package/@koa/cors · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._