# koa-cors

> CORS middleware for Koa

Latest version **0.0.16** (published 2015-06-08) · MIT license · 0 weekly downloads

## Install

```sh
npm install koa-cors
pnpm add koa-cors
yarn add koa-cors
bun add koa-cors
```

## Health

**Score 23/100 (F)** — status: abandoned.

Positive: has types package; no vulnerabilities; high quality score.

Warnings: low downloads; no esm support; pre 1.0.

Negative: abandoned; low maintenance score.

## Facts

| | |
|---|---|
| Version | 0.0.16 |
| Published | 2015-06-08 |
| First published | 2013-12-26 |
| Weekly downloads | 0 |
| License | MIT |
| TypeScript types | separate (@types/koa-cors) |
| Module format | CommonJS |
| Dependencies | 0 |
| Known vulnerabilities | 0 |
| Install scripts | no |
| GitHub stars | 243 |
| Author | Everton Yoshitani |
| Maintainers | evert0n |
| Keywords | cors, koa, koajs |

## Links

- npm: https://www.npmjs.com/package/koa-cors
- Repository: https://github.com/evert0n/koa-cors
- Issues: https://github.com/evert0n/koa-cors/issues
- npm.io page: https://npm.io/package/koa-cors

## Recent versions

- 0.0.16 (latest) — 2015-06-08
- 0.0.15 — 2015-06-08
- 0.0.14 — 2014-11-03
- 0.0.13 — 2014-05-24
- 0.0.12 — 2014-05-23
- 0.0.11 — 2014-05-21
- 0.0.10 — 2014-05-21
- 0.0.9 — 2014-05-21
- 0.0.8 — 2014-03-13
- 0.0.7 — 2014-03-11
- 0.0.6 — 2014-02-07
- 0.0.5 — 2014-01-05
- 0.0.3 — 2013-12-30
- 0.0.1 — 2013-12-26

## README

koa-cors
========

CORS middleware for Koa

Inspired by the great [node-cors](https://github.com/troygoode/node-cors) module.

## Installation (via [npm](https://npmjs.org/package/koa-cors))

```bash
$ npm install koa-cors
```

## Usage

```javascript
var koa = require('koa');
var route = require('koa-route');
var cors = require('koa-cors');
var app = koa();

app.use(cors());

app.use(route.get('/', function() {
  this.body = { msg: 'Hello World!' };
}));

app.listen(3000);
```

## Options

### origin

Configures the **Access-Control-Allow-Origin** CORS header. Expects a string
(ex: http://example.com). Set to `true` to reflect the
[request origin](http://tools.ietf.org/html/draft-abarth-origin-09), as defined
by `req.header('Origin')`. Set to `false` to disable CORS. Can also be set to a
function, which takes the request as the first parameter.

### expose

Configures the **Access-Control-Expose-Headers** CORS header. Expects a
comma-delimited string (ex: 'WWW-Authenticate,Server-Authorization') or an array
(ex: `['WWW-Authenticate', 'Server-Authorization]`). Set this to pass the
header, otherwise it is omitted.

### maxAge

Configures the **Access-Control-Max-Age** CORS header. Set to an integer to pass
the header, otherwise it is omitted.

### credentials

Configures the **Access-Control-Allow-Credentials** CORS header. Set to `true`
to pass the header, otherwise it is omitted.

### methods

Configures the **Access-Control-Allow-Methods** CORS header. Expects a
comma-delimited string (ex: 'GET,PUT,POST') or an array (ex: `['GET', 'PUT',
'POST']`).

### headers
Configures the **Access-Control-Allow-Headers** CORS header. Expects a
comma-delimited string (ex: 'Content-Type,Authorization') or an array (ex:
`['Content-Type', 'Authorization]`). If not specified, defaults to reflecting
the headers specified in the request's **Access-Control-Request-Headers**
header.


For details on the effect of each CORS header,
[read this article on HTML5 Rocks](http://www.html5rocks.com/en/tutorials/cors/).


## License

[MIT License](http://www.opensource.org/licenses/mit-license.php)

---
_Source: https://npm.io/package/koa-cors · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._