# @whook/cors > A wrapper to provide CORS support to a Whook server Latest version **26.2.0** (published 2026-09-07) · MIT license · 0 weekly downloads ## Install ```sh npm install @whook/cors pnpm add @whook/cors yarn add @whook/cors bun add @whook/cors ``` ## Health **Score 55/100 (C)** — status: active. Positive: no vulnerabilities; recently updated; high maintenance score. Warnings: low downloads; no types; no esm support. ## Facts | | | |---|---| | Version | 26.2.0 | | Published | 2026-09-07 | | First published | 2019-02-24 | | Weekly downloads | 0 | | License | MIT | | TypeScript types | none | | Module format | CommonJS | | Dependencies | 0 | | Known vulnerabilities | 0 | | Install scripts | no | | GitHub stars | 31 | | Author | Nicolas Froidure | | Maintainers | nfroidure | | Keywords | whook, knifecycle, REST, HTTP, OpenAPI, web, wrapper | ## Links - npm: https://www.npmjs.com/package/@whook/cors - Repository: https://github.com/nfroidure/whook - Issues: https://github.com/nfroidure/whook/issues - Funding: https://github.com/sponsors/nfroidure - npm.io page: https://npm.io/package/@whook/cors ## Alternatives - [launchdarkly-js-client-sdk](https://npm.io/package/launchdarkly-js-client-sdk.md) — 2.5M weekly downloads - [@elastic/elasticsearch](https://npm.io/package/@elastic/elasticsearch.md) — 2.1M weekly downloads - [@c8y/client](https://npm.io/package/@c8y/client.md) — 15.3K weekly downloads - [@signaldb/maverickjs](https://npm.io/package/@signaldb/maverickjs.md) — 1.7K weekly downloads - [@bbc/http-transport-cache](https://npm.io/package/@bbc/http-transport-cache.md) — 1.2K weekly downloads ## Recent versions - 26.2.0 (latest) — 2026-09-07 - 26.1.0 — 2026-08-26 - 26.0.5 — 2026-08-20 - 26.0.2 — 2026-08-11 - 26.0.0 — 2026-08-07 - 25.2.0 — 2026-07-19 - 25.1.0 — 2026-06-08 - 25.0.0 — 2026-05-18 - 24.1.1 — 2026-05-15 - 24.1.0 — 2026-05-13 - 24.0.1 — 2026-04-22 - 24.0.0 — 2026-04-22 - 23.0.0 — 2026-04-17 - 22.0.0 — 2026-04-08 - 21.0.1 — 2026-04-01 - … 126 more at https://npm.io/package/@whook/cors/versions ## README [//]: # ( ) [//]: # (This file is automatically generated by a `metapak`) [//]: # (module. Do not change it except between the) [//]: # (`content:start/end` flags, your changes would) [//]: # (be overridden.) [//]: # ( ) # @whook/cors > A wrapper to provide CORS support to a Whook server [![GitHub license](https://img.shields.io/badge/license-MIT-blue.svg)](https://github.com/nfroidure/whook/blob/main/packages/whook-cors/LICENSE) [//]: # (::contents:start) This [Whook](https://github.com/nfroidure/whook) wrapper provides CORS support by adding it to your OpenAPI file and creating the routes that runs the OPTIONS method when you cannot do it at the proxy/gateway level. ## Usage To use this plugin, simply install it: ```sh npm i @whook/cors; ``` Declare it in the `src/index.ts` file of your project: ```diff // ... $.register( constant('ROUTES_WRAPPERS_NAMES', [ + 'wrapRouteHandlerWithCORS', 'wrapRouteHandlerWithAuthorization', ]), ); // ... $.register( constant('WHOOK_PLUGINS', [ ...WHOOK_DEFAULT_PLUGINS, + '@whook/cors', '@whook/authorization', ]), ); // ... ``` Declare types in your `src/whook.d.ts` definition: ```diff + import { + type WhookCORSConfig, + type WhookCORSRouteConfig, + } from '@whook/cors'; declare module 'application-services' { // ... export interface AppConfig - extends WhookBaseConfigs {} + extends WhookBaseConfigs, WhookCORSConfig {} // ... } // ... declare module '@whook/whook' { export interface WhookRouteConfig - extends WhookBaseRouteConfig {} + extends WhookBaseRouteConfig, + WhookCORSRouteConfig {} } ``` And add the CORS config (usually in `src/config/common/config.js`): ```diff // ... import { type AppConfig } from 'application-services'; const CONFIG: AppConfig = { // ... + CORS: { + 'Access-Control-Allow-Origin': '*', + 'Access-Control-Allow-Methods': 'GET,POST,PUT,DELETE,OPTIONS', + 'Access-Control-Allow-Headers': [ + 'Accept', + 'Accept-Encoding', + 'Accept-Language', + 'Referrer', + 'Content-Type', + 'Content-Encoding', + 'Authorization', + 'Keep-Alive', + 'User-Agent', + ].join(','), + }, }; export default CONFIG; ``` You should also use the wrapped error handler: ```diff + import { + initErrorHandlerWithCORS, + wrapDefinitionsWithCORS, +} from '@whook/cors'; // ... export async function prepareEnvironment>( $: T = new Knifecycle() as T, ): Promise { //... + // Wrap the definitions for CORS + $.register(wrapDefinitionsWithCORS(initDefinitions)); + // Add the CORS wrapped error handler + $.register(initErrorHandlerWithCORS); return $; } ``` According to the kind of build you use, you may also declare it in your `src/build.ts` file: ```diff $.register( constant('INITIALIZER_PATH_MAP', { ...DEFAULT_BUILD_INITIALIZER_PATH_MAP, // MY_SERVICE: '@my/service_module_name', jwtToken: 'jwt-service/dist/index.js', + errorHandler: '@whook/cors/dist/services/errorHandler.js', }), ); ``` To see a real example have a look at the [`@whook/example`](https://github.com/nfroidure/whook/tree/master/packages/whook-example). Note that you can define individual CORS values on the handler definitions usins the `x-whook` property. [//]: # (::contents:end) # API ## Functions
wrapDefinitionsWithCORS(API) ⇒ Promise.<Object>

Augment an OpenAPI to also serve OPTIONS methods with the CORS added.

initOptionsWithCORS() ⇒ Promise.<Object>

A simple Whook handler that just returns a 200 OK HTTP response

wrapErrorHandlerForCORS(services) ⇒ Promise.<Object>

Wrap the error handler service as a last chance to add CORS

initWrapRouteHandlerWithCORS(services) ⇒ Promise.<Object>

Wrap a route handler to append CORS to response.

## wrapDefinitionsWithCORS(API) ⇒ Promise.<Object> Augment an OpenAPI to also serve OPTIONS methods with the CORS added. **Kind**: global function **Returns**: Promise.<Object> - The augmented OpenAPI object | Param | Type | Description | | --- | --- | --- | | API | Object | The OpenAPI object | ## initOptionsWithCORS() ⇒ Promise.<Object> A simple Whook handler that just returns a 200 OK HTTP response **Kind**: global function **Returns**: Promise.<Object> - The HTTP response object ## wrapErrorHandlerForCORS(services) ⇒ Promise.<Object> Wrap the error handler service as a last chance to add CORS **Kind**: global function **Returns**: Promise.<Object> - A promise of an object containing the reshaped env vars. | Param | Type | Default | Description | | --- | --- | --- | --- | | services | Object | | The service dependencies | | services.CORS | Object | | A CORS object to be added to errors responses | | [services.log] | Object | noop | An optional logging service | ## initWrapRouteHandlerWithCORS(services) ⇒ Promise.<Object> Wrap a route handler to append CORS to response. **Kind**: global function **Returns**: Promise.<Object> - A promise of an object containing the reshaped env vars. | Param | Type | Default | Description | | --- | --- | --- | --- | | services | Object | | The service dependencies | | services.CORS | Object | | A CORS object to be added to errors responses | | [services.log] | Object | noop | An optional logging service | # Authors - [Nicolas Froidure](http://insertafter.com/en/index.html) # License [MIT](https://github.com/nfroidure/whook/blob/main/packages/whook-cors/LICENSE) --- _Source: https://npm.io/package/@whook/cors · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._