Security Middleware

CORS Configuration

Secure cross-origin requests made simple. Enable CORS with one line, configure origins, and protect your API automatically.

Overview

Without CORS, browsers block cross-origin requests. With CORS, you control which origins can access your API securely. Traditional CORS setup requires manual header management and preflight handling. We handle that automatically.

Enable CORS with one linetypescript

1import { createApp } from '@morojs/moro';
2
3const app = await createApp({
4  cors: true // That's it!
5});
6
7// All routes now support CORS automatically
8app.get('/users', () => {
9  return { success: true, data: [] };
10});

Without CORS

Browsers block cross-origin requests
Manual header management
Complex preflight handling
Security configuration errors

With MoroJS

One-line CORS enablement
Automatic preflight handling
Secure defaults
Flexible configuration

Configure allowed originstypescript

1const app = await createApp({
2  cors: {
3    origin: ['https://app.example.com', 'https://admin.example.com'],
4    credentials: true,
5    methods: ['GET', 'POST', 'PUT', 'DELETE']
6  }
7});

Secure

Control which origins can access your API. Secure by default.

Automatic

Preflight requests handled automatically. No manual header management.

Flexible

Configure per-route or globally. Environment-specific settings.

How It Works

MoroJS automatically handles CORS preflight requests, validates origins against your allowed list, and sets appropriate headers. When CORS is enabled, all routes automatically support cross-origin requests according to your configuration.

Configuration

Simple CORS Configurationtypescript

1import { createApp } from '@morojs/moro';
2
3// Enable CORS with default settings
4const app = await createApp({
5  cors: true // Allows all origins in development
6});
7
8// Routes automatically inherit CORS settings
9app.get('/users', () => {
10  return { success: true, data: [] };
11});

Configure Allowed Originstypescript

1const app = await createApp({
2  cors: {
3    origin: [
4      'https://app.example.com',
5      'https://admin.example.com',
6      'https://mobile.example.com'
7    ],
8    credentials: true,
9    methods: ['GET', 'POST', 'PUT', 'DELETE'],
10    allowedHeaders: ['Content-Type', 'Authorization']
11  }
12});

Environment-Specific Configurationtypescript

1const getCorsConfig = () => {
2  const env = process.env.NODE_ENV;
3
4  if (env === 'development') {
5    return { origin: true }; // Allow all origins
6  }
7
8  if (env === 'production') {
9    return {
10      origin: ['https://app.example.com'],
11      credentials: true,
12      maxAge: 86400 // 24 hours
13    };
14  }
15
16  return false; // Disable CORS
17};
18
19const app = await createApp({
20  cors: getCorsConfig()
21});

Advanced Configuration

For advanced use cases, you can configure dynamic origin validation, per-route CORS settings, and database-driven origin management.

Dynamic Origin Validationtypescript

1const app = await createApp({
2  cors: {
3    origin: (origin, callback) => {
4      // Allow requests with no origin (mobile apps, etc.)
5      if (!origin) return callback(null, true);
6
7      // Check against allowed domains
8      const allowedDomains = ['example.com', 'staging.example.com'];
9      const hostname = new URL(origin).hostname;
10      const isAllowed = allowedDomains.some(domain =>
11        hostname === domain || hostname.endsWith('.' + domain)
12      );
13
14      callback(null, isAllowed);
15    },
16    credentials: true
17  }
18});

Route-Specific CORStypescript

1// Public API - Allow all origins
2app.get('/api/public/data')
3  .use(cors({
4    origin: '*',
5    methods: ['GET'],
6    credentials: false
7  }))
8  .handler(() => ({ message: 'Public data' }));
9
10// Admin API - Restricted origins
11app.post('/api/admin/users')
12  .use(cors({
13    origin: ['https://admin.example.com'],
14    credentials: true
15  }))
16  .handler(createUser);