"Access-Control-Allow-Origin" is not added to headers

[nahwinrajan]

It started with having problem for CORS between my front-end (angular2) and back-end (expressjs). Some StackOverflow recommend to use cors-package (for answers in 2016 against those from 2013-2014).

I've used following configuration and CORS still not adding "Access-Control-Allow-Origin":

cors            = require('cors'),

const originsWhiteList = {
  "http://localhost:3001": true   // front-end development port
};

const corsOptions = {
  origin: function(origin, callback) {
    callback(originsWhiteList[origin] ? null : 'Bad Request', originsWhiteList[origin]);
  },
  credentials: true,
  methods: ['GET', 'POST', 'PUT', 'DELETE']
}
.
.
.
// just right before other routes
app.use(cors(corsOptions));
app.options('/api/v1/*', cors());

this should be classified as bug, right ?

the exact error:

XMLHttpRequest cannot load http://localhost:3000/api/v1/todos. No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://localhost:3001' is therefore not allowed access. The response had HTTP status code 403.

[dougwilson]

This is not a bug, rather you accidentally made a mistake in your origin function. The second argument to callback needs to be the string of the origin to allow, but instead you are passing originsWhiteList[origin], which is actually the value true. Your function should be the following:

  origin: function(origin, callback) {
    callback(originsWhiteList[origin] ? null : 'Bad Request', origin);
  },

[nahwinrajan]

Function - set origin to a function implementing some custom logic. The function takes the request origin as the first parameter and a callback (which expects the signature err [object], allow [bool]) as the second.

the readme file state the second callback's parameter is a boolean

[dougwilson]

Weird, then not sure. Can you issue a PR that fixes the issue you are having?

[nahwinrajan]

I believe that only fault is at ReadMe.md file only,
the function actually expecting string of the allowed url (origin url, as you suggested)

[dougwilson]

So after spending the past week getting to know this module better to help maintain it--it turns out that both are correct. The second argument you give to the callback can actually be any valid value to the origin option (so, an array, a string, a boolean, etc.).