How to Configure CORS Correctly in Node.js (Stop Using *)

What CORS Is and How It Actually Works

CORS (Cross-Origin Resource Sharing) is a browser security mechanism. Its entire purpose is to allow servers to relax the browser''s Same-Origin Policy (SOP) for specific trusted origins.

The Same-Origin Policy prevents a JavaScript application running on https://app.com from reading responses from https://api.other.com. This protects users from malicious sites silently making authenticated requests to other APIs using the user''s cookies.

CORS does not: - Prevent non-browser clients (curl, Postman, server-to-server requests) from accessing your API - Provide authentication - Encrypt traffic - Validate the identity of the caller

It only tells the browser whether to allow a cross-origin request to proceed and whether to expose the response to JavaScript.

The Preflight Flow

For any request that is not a "simple request" (GET/POST with specific content types), the browser first sends an OPTIONS preflight request to check if the actual request is allowed:

Your server must respond with headers that grant permission:

Then the browser makes the actual request. If the preflight fails, the browser blocks the request and you see the CORS error in the console.

Why Wildcard Is Dangerous

Access-Control-Allow-Origin: * means the browser allows any website on the internet to make requests to your API and read the responses.

Why * breaks with credentials

The browser specification prohibits Access-Control-Allow-Origin: * when Access-Control-Allow-Credentials: true. If you try to use both, the browser blocks the request. This is why you will see this error:

This is good — the combination would allow any site to make credentialed requests to your API.

The real problem with *

Even without credentials, a wildcard CORS policy allows authenticated single-page applications to be used as a vector. Here is a real attack scenario:

1. 1A user is logged into your app at https://app.yourdomain.com
2. 2They visit https://evil.com
3. 3evil.com uses JavaScript to make a request to your API with the user''s session cookies
4. 4With *, the browser allows the response to be read

If your API relies solely on CORS to restrict access (it should not, but many do in development), a wildcard policy is a complete bypass.

Configuring a Secure Origin Allowlist in Express

Basic allowlist

Environment-based origins

Handling Credentials Correctly

When your frontend sends cookies or Authorization headers cross-origin, both the server and the client must opt in.

Server side

Client side (fetch)

Client side (axios)

If the client sends credentials: "include" but the server does not respond with Access-Control-Allow-Credentials: true, the browser discards the response.

Per-Route CORS Configuration

Not all API routes need the same CORS policy. Public endpoints can use *. Authenticated endpoints need a strict allowlist.

Common CORS Mistakes

Mistake 1: Applying CORS middleware after route definitions

Mistake 2: Forgetting to handle preflight OPTIONS

The cors() middleware handles preflight automatically when used with app.use(). But if you are only applying CORS to specific routes, you must also handle OPTIONS:

Mistake 3: Regex origin matching that is too broad

Mistake 4: Not validating origin before reflecting it

Reflecting the incoming Origin back without validation is a critical vulnerability. Never do this:

Always validate against an explicit allowlist before reflecting.

Mistake 5: Confusing CORS with authentication

CORS is not an authentication mechanism. A 403 Forbidden from your CORS policy only affects browsers. Any server, script, or tool that is not a browser can ignore CORS entirely. Always implement proper authentication (API keys, JWTs, session tokens) independently of your CORS configuration.

Debugging CORS Errors

"No ''Access-Control-Allow-Origin'' header is present"

Your server is not returning CORS headers at all. Check: - Is cors() middleware applied globally (app.use(cors(options))) or per-route? - Is the middleware applied before the route handler? - Is the server restarted after configuration changes?

"The ''Access-Control-Allow-Origin'' header has a value ''...'' that is not equal to the supplied origin"

Your origin allowlist does not include the requesting origin. Log the incoming origin value and verify it matches exactly (including protocol, no trailing slash):

Credentials + wildcard error

Change origin: "*" to your specific origin and ensure credentials: true is set.

Preflight response has no CORS headers

You are handling the preflight OPTIONS request somewhere before the CORS middleware (e.g., another middleware that intercepts OPTIONS and returns a 404). Add explicit OPTIONS handling:

CORS for Fastify

Testing Your CORS Configuration

For a full automated check including your deployed CORS headers alongside all other security headers, run a free scan at zeriflow.com/free-scan.

Summary

CORS in Node.js should never use a wildcard origin for authenticated endpoints. The correct pattern is an explicit origin allowlist in the cors() callback, credentials: true for cookie/token-based auth, explicit OPTIONS preflight handling, and environment-based configuration that adds localhost only in development. CORS is a browser-only mechanism and does not replace authentication — it is a layer on top. Configure your allowlist carefully, handle preflight requests explicitly, and test from both allowed and disallowed origins to verify your policy is working as intended.