cors express preflight: working versions (tested 2026-10-16)

{
  "name": "cors-express-preflight",
  "private": true,
  "type": "module",
  "scripts": {
    "test": "node --import tsx --test test/*.test.ts"
  },
  "dependencies": {
    "cors": "2.8.6",
    "express": "5.3.0"
  },
  "devDependencies": {
    "supertest": "7.3.1",
    "@types/cors": "2.8.19",
    "@types/express": "5.0.6",
    "@types/supertest": "7.2.1",
    "@types/node": "26.6.5",
    "tsx": "4.23.15"
  }
}

import express, { type Express } from "express";
import cors, { type CorsOptions } from "cors";

export const defaultAllowedOrigins = [
  "https://app.example.com",
  "https://admin.example.com",
];

export function createApp(allowedOrigins: string[] = defaultAllowedOrigins): Express {
  const app = express();

  const corsOptions: CorsOptions = {
    origin(origin, callback) {
      if (!origin) {
        callback(null, true);
        return;
      }
      callback(null, allowedOrigins.includes(origin));
    },
    credentials: true,
    methods: ["GET", "POST", "OPTIONS"],
    allowedHeaders: ["Content-Type", "Authorization"],
    optionsSuccessStatus: 204,
  };

  app.use(cors(corsOptions));
  app.use(express.json());

  app.get("/health", (_req, res) => {
    res.json({ ok: true });
  });

  app.post("/echo", (req, res) => {
    res.json({ received: req.body ?? null });
  });

  return app;
}

import { test } from "node:test";
import assert from "node:assert/strict";
import request from "supertest";
import { createApp } from "../src/app.ts";

test("reflects an allowed origin on a simple request", async () => {
  const app = createApp();
  const res = await request(app)
    .get("/health")
    .set("Origin", "https://app.example.com");

  assert.equal(res.status, 200);
  assert.equal(res.headers["access-control-allow-origin"], "https://app.example.com");
  assert.equal(res.headers["access-control-allow-credentials"], "true");
  assert.deepEqual(res.body, { ok: true });
});

test("answers OPTIONS preflight with Access-Control-Allow-* headers", async () => {
  const app = createApp();
  const res = await request(app)
    .options("/echo")
    .set("Origin", "https://admin.example.com")
    .set("Access-Control-Request-Method", "POST")
    .set("Access-Control-Request-Headers", "content-type");

  assert.equal(res.status, 204);
  assert.equal(res.headers["access-control-allow-origin"], "https://admin.example.com");
  assert.equal(res.headers["access-control-allow-credentials"], "true");
  assert.match(res.headers["access-control-allow-methods"], /POST/);
  assert.match(res.headers["access-control-allow-headers"], /content-type/i);
});

test("denies a disallowed origin by omitting the allow-origin header", async () => {
  const app = createApp();
  const res = await request(app)
    .get("/health")
    .set("Origin", "https://evil.example.com");

  assert.equal(res.headers["access-control-allow-origin"], undefined);
  assert.equal(res.headers["access-control-allow-credentials"], undefined);
});