CORS & Browser Access

Complete non-credentialed example

import { Volt, cors } from 'voltts';

const app = new Volt();
app.use(cors({
  origin: ['http://localhost:5173'],
  methods: ['GET', 'POST', 'OPTIONS'],
  allowedHeaders: ['Content-Type', 'Authorization'],
}));
app.get('/products', () => ({ products: [] }));
if (globalThis._importMeta_.main) app.listen(3000);
export default app;

Test preflight

bun run index.ts
curl -i -X OPTIONS http://localhost:3000/products -H 'Origin: http://localhost:5173' -H 'Access-Control-Request-Method: GET'

Expect 204 with Access-Control-Allow-Origin for the allowed origin. Test allowed and rejected origins before enabling a browser client.

Middleware or plugin

cors(options) is middleware for app.use(). corsPlugin(options) is the plugin wrapper for app.plugin(). Supported options include origin, methods, allowedHeaders, exposedHeaders, credentials, and maxAge. Register either before routes; do not register both for the same purpose.

Credentialed requests

The current implementation can reflect a disallowed origin when credentials is true. Do not rely on origin arrays alone for credentialed browser access until that implementation is fixed. Enforce the policy in a trusted upstream or a custom origin check. CORS is a browser policy, not API authentication or authorization.