CorsOptions

Kind: Interface

Source: packages/common/interfaces/external/cors-options.interface.ts

Part of: Common

Interface describing CORS options that can be set.

CorsOptions defines the Cross-Origin Resource Sharing (CORS) configuration accepted by the application’s HTTP layer. Use it to control which origins, methods, and headers browsers may use when making cross-origin requests, as well as how preflight OPTIONS requests are handled.

Properties

Diagram

mermaid
graph LR
  App[Application Bootstrap] --> Options[CorsOptions]
  Options --> Origin[origin: StaticOrigin | CustomOrigin]
  Options --> Methods[methods: string | string[]]
  Options --> Headers[allowedHeaders / exposedHeaders]
  Options --> Credentials[credentials: boolean]
  Options --> Preflight[Preflight Settings]
  Preflight --> MaxAge[maxAge]
  Preflight --> Continue[preflightContinue]
  Preflight --> Status[optionsSuccessStatus]
  Options --> Middleware[CORS Middleware]
  Middleware --> Browser[Browser Cross-Origin Requests]

Usage

ts
import type { CorsOptions } from '@nestjs/common/interfaces/external/cors-options.interface';

const corsOptions: CorsOptions = {
  origin: ['https://app.example.com', 'https://admin.example.com'],
  methods: ['GET', 'POST', 'PUT', 'PATCH', 'DELETE'],
  allowedHeaders: ['Content-Type', 'Authorization'],
  exposedHeaders: ['X-Request-Id'],
  credentials: true,
  maxAge: 86400,
  optionsSuccessStatus: 204,
};

// Example application integration
app.enableCors(corsOptions);

AI Coding Instructions

• Provide origin as a static origin value or a custom origin callback when origin validation must be dynamic.
• Enable credentials only when required; credentialed requests should not use a wildcard (*) origin.
• Include all custom request headers in allowedHeaders, especially headers such as Authorization.
• Set maxAge to reduce repeated browser preflight requests for stable API policies.
• Use optionsSuccessStatus for clients that require a specific successful response status for OPTIONS requests.

Used by

2 references from 2 files. Each is a place in this repository where the symbol is actually used — go read one rather than trusting an example.

Imported by (2)

• ExpressAdapter — packages/platform-express/adapters/express-adapter.ts:51
• GatewayMetadata — packages/websockets/interfaces/gateway-metadata.interface.ts:8