Search results

Add a note in the docs about origin: true and credentials: true being dangerous

docs

Status: Open.

#422 In expressjs/cors;

· jonchurch opened on Jun 23, 2026

Security: README regex example allows unintended origin matching

Status: Open.

#408 In expressjs/cors;

· ekreloff opened on Mar 30, 2026

Docs should better explain what this package actually does

docs

Status: Open.

#384 In expressjs/cors;

· jonchurch opened on Jan 12, 2026

Allows CORS for any routes, including OPTIONS: documentation is obsolete

Status: Open.

#360 In expressjs/cors;

· ghost opened on Jun 27, 2025

CORS requests with credentials should forbid *

3.x

bug

help wanted

Status: Open.

#333 In expressjs/cors;

· ehmicky opened on Oct 19, 2024

Vary: Origin should not be set if the Origin request header is ignored

3.x

bug

help wanted

Status: Open.

#332 In expressjs/cors;

· ehmicky opened on Oct 19, 2024

Vary: Origin should be set on non-CORS request

3.x

bug

help wanted

Status: Open.

#330 In expressjs/cors;

· ehmicky opened on Oct 18, 2024

Add ability to omit Vary: Origin header

enhancement

help wanted

Status: Open.

#317 In expressjs/cors;

· gl-jkeys opened on Mar 21, 2024

Add support for having specified domain instead of wildcard

Status: Open.

#310 In expressjs/cors;

· dani2819 opened on Dec 20, 2023

CORS error when fonts

Status: Open.

#309 In expressjs/cors;

· banyalis opened on Dec 19, 2023

OPTIONS request handler missing Allow header

investigate

Status: Open.

#305 In expressjs/cors;

· Lordfirespeed opened on Sep 20, 2023

DEMO is broken

docs

Status: Open.

#301 In expressjs/cors;

· Zirafnik opened on May 28, 2023