CORS: Real-World Examples

CORS: Real-World Examples

Express.js with cors middleware

const cors = require("cors");
app.use(cors({
  origin: ["https://myapp.com", "https://admin.myapp.com"],
  methods: ["GET", "POST", "PUT", "DELETE"],
  credentials: true,
}));

Next.js API Routes

export default function handler(req, res) {
  res.setHeader("Access-Control-Allow-Origin", "https://myapp.com");
  res.setHeader("Access-Control-Allow-Methods", "GET, POST");
  if (req.method === "OPTIONS") return res.status(204).end();
  // handle request
}

Vite Dev Proxy

// vite.config.js
export default {
  server: {
    proxy: { "/api": { target: "https://api.example.com", changeOrigin: true } }
  }
};

Nginx

location /api/ {
  add_header Access-Control-Allow-Origin "https://myapp.com";
  add_header Access-Control-Allow-Methods "GET, POST, PUT, DELETE";
  if ($request_method = OPTIONS) { return 204; }
  proxy_pass https://backend;
}

The Takeaway

Real-world CORS: Express (cors middleware), Next.js (set headers in API routes), Vite (dev proxy to avoid CORS in development), and Nginx (add_header for CORS). Always handle OPTIONS preflight with 204. Use a proxy in development to avoid CORS entirely.