# CorsOptions

**Kind:** Interface

**Source:** [`packages/common/interfaces/external/cors-options.interface.ts`](https://github.com/nestjs/nest/blob/master/packages/common/interfaces/external/cors-options.interface.ts#L23)

**Part of:** [Common](subsystem-packages-common)

Interface describing CORS options that can be set.

`CorsOptions` defines the Cross-Origin Resource Sharing (CORS) configuration accepted by the application’s HTTP layer. Use it to control which origins, methods, and headers browsers may use when making cross-origin requests, as well as how preflight `OPTIONS` requests are handled.

## Properties

| Property | Type |
|---|---|
| `origin` | `StaticOrigin | CustomOrigin` |
| `methods` | `string | string[]` |
| `allowedHeaders` | `string | string[]` |
| `exposedHeaders` | `string | string[]` |
| `credentials` | `boolean` |
| `maxAge` | `number` |
| `preflightContinue` | `boolean` |
| `optionsSuccessStatus` | `number` |

## Diagram

```mermaid
graph LR
  App[Application Bootstrap] --> Options[CorsOptions]
  Options --> Origin[origin: StaticOrigin | CustomOrigin]
  Options --> Methods[methods: string | string[]]
  Options --> Headers[allowedHeaders / exposedHeaders]
  Options --> Credentials[credentials: boolean]
  Options --> Preflight[Preflight Settings]
  Preflight --> MaxAge[maxAge]
  Preflight --> Continue[preflightContinue]
  Preflight --> Status[optionsSuccessStatus]
  Options --> Middleware[CORS Middleware]
  Middleware --> Browser[Browser Cross-Origin Requests]
```

## Usage

```ts
import type { CorsOptions } from '@nestjs/common/interfaces/external/cors-options.interface';

const corsOptions: CorsOptions = {
  origin: ['https://app.example.com', 'https://admin.example.com'],
  methods: ['GET', 'POST', 'PUT', 'PATCH', 'DELETE'],
  allowedHeaders: ['Content-Type', 'Authorization'],
  exposedHeaders: ['X-Request-Id'],
  credentials: true,
  maxAge: 86400,
  optionsSuccessStatus: 204,
};

// Example application integration
app.enableCors(corsOptions);
```

## AI Coding Instructions

- Provide `origin` as a static origin value or a custom origin callback when origin validation must be dynamic.
- Enable `credentials` only when required; credentialed requests should not use a wildcard (`*`) origin.
- Include all custom request headers in `allowedHeaders`, especially headers such as `Authorization`.
- Set `maxAge` to reduce repeated browser preflight requests for stable API policies.
- Use `optionsSuccessStatus` for clients that require a specific successful response status for `OPTIONS` requests.

## Used by

2 references from 2 files. Each is a place in this repository where the symbol is actually used — go read one rather than trusting an example.

### Imported by (2)

- `ExpressAdapter` — `packages/platform-express/adapters/express-adapter.ts`:51
- `GatewayMetadata` — `packages/websockets/interfaces/gateway-metadata.interface.ts`:8