CORS in API

CORS, or Cross-Origin Resource Sharing, is a security feature implemented in web browsers to control access to resources from different origins. In the context of APIs, CORS is used to determine which requests to allow or block based on the origin and HTTP headers sent by the requesting client.

How CORS works

When a client sends a request to an API, it includes an Origin header, which specifies the domain from which the request originated. The API server checks this header and compares it against a list of allowed origins. If the origin is not on the list, the server returns a CORS error and blocks the request.

If the origin is on the list, the server can respond with additional headers that define which HTTP methods (GET, POST, etc.) and headers are allowed for that origin. These headers are called CORS response headers, and they include headers like Access-Control-Allow-Origin and Access-Control-Allow-Methods.

Implementing CORS in API

To implement CORS in your API, you need to configure your server to check the Origin header and add the appropriate response headers. Here's an example of how to implement CORS in Node.js using the cors middleware:

const express = require('express');
const cors = require('cors');
const app = express();

// Allow requests from all origins
app.use(cors());

// Allow requests from specific origins
app.use(cors({
  origin: 'https://example.com'
}));

// Allow requests for specific HTTP methods and headers
app.use(cors({
  methods: ['GET', 'POST', 'PUT'],
  headers: ['Content-Type', 'Authorization']
}));

In this example, the first app.use(cors()) statement allows requests from all origins, while the second app.use(cors({ origin: 'https://example.com' })) statement only allows requests from the https://example.com domain. The third app.use(cors({ methods: ['GET', 'POST', 'PUT'], headers: ['Content-Type', 'Authorization'] })) statement only allows requests for the specified HTTP methods and headers.

Conclusion

Implementing CORS in your API is an important security measure that helps to prevent unauthorized access to your resources. By checking the Origin header and adding appropriate response headers, you can control which requests to allow or block based on the origin and HTTP headers sent by the client.