You're Invited:Meet the Socket Team at BlackHat and DEF CON in Las Vegas, Aug 7-8.RSVP
Socket
Socket
Sign inDemoInstall

access-control

Package Overview
Dependencies
8
Maintainers
6
Versions
11
Alerts
File Explorer

Advanced tools

Install Socket

Detect and block malicious and high-risk dependencies

Install

access-control

Easily handle HTTP Access Control (CORS) in your applications


Version published
Maintainers
6
Created

Readme

Source

HTTP Access-Control (CORS)

Version npmBuild StatusDependenciesCoverage StatusIRC channel

access-control implements HTTP Access Control, which more commonly known as CORS according to the W3 specification. The code is dead simple, easy to understand and therefor also easy to contribute to. access-control comes with a really simple API, so it's super simple, super awesome, super stable. All you expect from a small building block module as this.

Installation

npm install --save access-control

Usage

The module must first be configured before it can be used to add the correct CORS information to your HTTP requests. This is done by suppling the module with options.

'use strict';

var access = require('access-control');

After requiring the module you can supply the returned function with an options object which can contain the following properties:

origins
An Array or comma separated list of origins that are allowed to access the URL. If this option is not supplied it will default to * which will allow every origin.
methods
An Array or comma separated list of HTTP methods that can be used to access the URL. This defaults to GET, HEAD, PUT, POST, DELETE and OPTIONS.
credentials
Allow sending of authorization and cookie information in the request. If this option is set to true (which is also the default value) in combination with the origins option to set to * we will automatically change the Access-Control-Allow-Origin header to the sent Origin header. As * as origin in combination with true as value is not allowed by the specification.
maxAge
The maximum duration that a client can cache the response of the preflight or OPTIONS request. The value can be set in numbers or a human readable string which we will parse with the ms module. We default to 30 days.
headers
An Array or comma separated list of headers that is allowed to be sent to the server. This option is disabled by default.
exposed
An Array or comma separated list of headers that is exposed to the client that makes the request. This option is disabled by default.
var cors = access({
  maxAge: '1 hour',
  credentials: true,
  origins: 'http://example.com'
});

Now the cors variable contains a function that should receive your request and response. So it's as easy as:

var http = require('http').createServer(function (req, res) {
  if (cors(req, res)) return;

  res.end('hello world');
}).listen(8080);

You might have noticed that we've added an if statement around our cors function call. This is because the module will be answering the preflight request for you. So when it returns the boolean true you don't have to respond the request any more. In addition to the answering the option request is also answer the requests with a 403 Forbidden when the validation of the Access Control is failing.

In order to not waste to much bandwidth, the CORS headers will only be added if the request contains an Origin header, which should be sent by every request that requires HTTP Access Control information.

middleware

The library has build-in support for express based middleware (req, res, next). In fact, it's build in to the returned function so all you need to do is:

var app = express();

app.use(require('access-control')({ /* options here */ }));

And you have CORS handling enabled on your express instance. It's that easy.

Phonegap & Origin: null

If you're using Phonegap, your XHR requests will be sent with Origin: null as Origin header. In order to resolve this you must add the domain you are requesting to your origin white list:

http://docs.phonegap.com/en/1.9.0/guide_whitelist_index.md.html

This will ensure that the correct headers will be used for these cross domain/origin requests.

If you're interested in learning more about HTTP Access Control (CORS) here's a good list to get started with:

License

MIT

Keywords

FAQs

Package last updated on 29 Jul 2018

Did you know?

Socket

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Install

Related posts

SocketSocket SOC 2 Logo

Product

  • Package Alerts
  • Integrations
  • Docs
  • Pricing
  • FAQ
  • Roadmap
  • Changelog

Packages

Stay in touch

Get open source security insights delivered straight into your inbox.


  • Terms
  • Privacy
  • Security

Made with ⚡️ by Socket Inc