CORS in Express: Fix the CORS Error (With and Without cors)

A CORS error ("No 'Access-Control-Allow-Origin' header is present") means a web page on one origin, such as http://localhost:5173, called your API on another origin, and the browser refused to let the page read the response because the response did not say that origin was allowed. The fix is on the server: send Access-Control-Allow-Origin with the page's origin, and answer the browser's preflight OPTIONS request with the methods and headers you accept. In Express that is a few lines of middleware, or app.use(cors()) from the cors package.

const express = require('express');
const app = express();

const ALLOWED_ORIGIN = 'https://app.example.com';

function cors(req, res, next) {
    res.set('Access-Control-Allow-Origin', ALLOWED_ORIGIN);
    res.set('Vary', 'Origin');
    if (req.method === 'OPTIONS') {
        res.set('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE');
        res.set('Access-Control-Allow-Headers', 'Content-Type, Authorization');
        res.set('Access-Control-Max-Age', '600');
        return res.sendStatus(204);
    }
    next();
}

app.use(cors);

app.get('/api/products', (req, res) => {
    res.json([{ id: 1, name: 'Lamp' }]);
});

app.put('/api/products/:id', (req, res) => {
    res.json({ updated: req.params.id });
});

// GET /api/products
app.listen(3000);

The response is the product list, and its Headers tab shows access-control-allow-origin: https://app.example.com: a page on that origin may read it. Now send OPTIONS /api/products/1 with the headers Origin: https://app.example.com and Access-Control-Request-Method: PUT. That is the preflight a browser sends before a PUT, and the answer is 204 with the allowed methods and headers and no body.

What the browser checks

Same-origin pages need nothing. For a cross-origin request the browser reads these response headers:

A simple GET or form-style POST goes straight to the server, and the browser checks Access-Control-Allow-Origin on the answer. The server still runs the request; CORS only decides whether the page sees the result. A request with a JSON body, an Authorization header, or a method like PUT or DELETE is preceded by a preflight OPTIONS request, and the real request is sent only if the preflight answer allows it. That is why a CORS middleware must answer OPTIONS before any route or auth check runs.

Allow several origins, with credentials

Access-Control-Allow-Origin holds one origin or *, never a list. To allow several, compare the request's Origin header with an allow list and echo it back when it matches:

const express = require('express');
const app = express();

const allowed = new Set(['https://app.example.com', 'http://localhost:5173']);

app.use((req, res, next) => {
    const origin = req.get('origin');
    if (origin && allowed.has(origin)) {
        res.set('Access-Control-Allow-Origin', origin);
        res.set('Access-Control-Allow-Credentials', 'true');
    }
    res.set('Vary', 'Origin');
    if (req.method === 'OPTIONS') {
        res.set('Access-Control-Allow-Methods', 'GET, POST');
        res.set('Access-Control-Allow-Headers', 'Content-Type');
        return res.sendStatus(204);
    }
    next();
});

app.get('/api/me', (req, res) => {
    res.json({ origin: req.get('origin') ?? null });
});

app.listen(3000);

The first request has no Origin header, like a call from curl or a same-origin page, so it gets {"origin":null} and no CORS headers. Send GET /api/me with the header Origin: http://localhost:5173 and the Headers tab shows that origin echoed back plus access-control-allow-credentials: true. Change the header to Origin: https://evil.example and both CORS headers disappear: the server still answers, but a browser would block the page from reading it. Access-Control-Allow-Credentials: true lets the page send cookies (with fetch(url, { credentials: 'include' })), and browsers reject it together with *, so credentials always need the exact origin.

The cors package

The cors package does the same work with options. Install it with npm install cors:

const cors = require('cors');

// Any origin, no cookies: fine for a public read-only API.
app.use(cors());

// Only your frontend, with cookies.
app.use(cors({
    origin: ['https://app.example.com', 'http://localhost:5173'],
    credentials: true,
    methods: ['GET', 'POST', 'PUT', 'DELETE'],
}));

// One route only.
app.get('/api/public', cors(), handler);

Called with no options, cors() sends Access-Control-Allow-Origin: * and answers every preflight. Use * only for public data that needs no login.

Common mistakes

Adding CORS after the routes or after an auth middleware. The preflight OPTIONS request carries no Authorization header, so an auth check placed first answers it with 401 and the browser reports a CORS error. Register the CORS middleware first.

Setting * with credentials. Browsers refuse the response. Echo the specific origin instead.

Trying to fix CORS in the frontend. Request options such as mode: 'no-cors' do not lift the restriction; they give you an opaque response you cannot read. Only the server's headers fix it.

For how app.use() and the order of middleware work, see Express middleware.