cors
CORS (Cross-Origin Resource Sharing) middleware for handling cross-origin requests in Buntal applications. Answers OPTIONS preflight requests with 204; register it before auth().
Source
Type Definition
function cors(options?: CorsOptions): AtomicHandler
type CorsOptions = {
origin?: string | string[]
methods?: string | string[]
allowedHeaders?: string | string[]
exposedHeaders?: string | string[]
maxAge?: number
credentials?: boolean
}Parameters
| Parameter | Type | Required | Default | Description |
|---|---|---|---|---|
options | CorsOptions | ❌ | - | CORS configuration options |
Properties
| Property | Type | Required | Default | Description |
|---|---|---|---|---|
origin | string | string[] | ❌ | * | Allowed origins. An array is an allow list: the matching request origin is echoed with Vary: Origin, other origins get no CORS headers |
methods | string | string[] | ❌ | GET, HEAD, PUT, PATCH, POST, DELETE | Allowed HTTP methods |
allowedHeaders | string | string[] | ❌ | Content-Type, Authorization, X-Requested-With | Allowed request headers |
exposedHeaders | string | string[] | ❌ | - | Headers exposed to the client |
maxAge | number | ❌ | 600 | Preflight request cache duration in seconds |
credentials | boolean | ❌ | true | Send Access-Control-Allow-Credentials for allow-listed origins. Never sent with origin * |
Last modified: 2026-10-02