Why CORS matters for APIs in Express - Test Your Understanding

Practice - 5 Tasks

1fill in blank

easy

Complete the code to enable CORS in an Express app.

Express

const express = require('express');
const cors = require('[1]');
const app = express();
app.use(cors());
app.listen(3000);

Drag options to blanks, or click blank then click option'

Aexpress

Bhttp

Ccors

Dbody-parser

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'express' instead of 'cors' for CORS middleware.

Forgetting to require the 'cors' package.

The cors package is used to enable CORS in Express apps.

2fill in blank

medium

Complete the code to allow only requests from 'https://example.com'.

Express

app.use(cors({ origin: '[1]' }));

Drag options to blanks, or click blank then click option'

Anull

B*

Chttp://localhost:3000

Dhttps://example.com

Attempts:

3 left

💡 Hint

Common Mistakes

Using '*' which allows all origins instead of a specific URL.

Using 'null' which blocks all origins.

Setting origin to 'https://example.com' restricts access to that domain only.

3fill in blank

hard

Fix the error in the CORS setup to allow credentials.

Express

app.use(cors({ origin: 'https://myapp.com', credentials: [1] }));

Drag options to blanks, or click blank then click option'

A1

Btrue

C'true'

D'yes'

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'true' as a string instead of boolean true.

Using numbers or other strings instead of boolean.

The credentials option expects a boolean true, not a string.

4fill in blank

hard

Fill both blanks to restrict CORS to GET and POST methods only.

Express

app.use(cors({ methods: ['[1]', '[2]'] }));

Drag options to blanks, or click blank then click option'

AGET

BPOST

CPUT

DDELETE

Attempts:

3 left

💡 Hint

Common Mistakes

Including methods like PUT or DELETE which are not allowed here.

Using lowercase method names instead of uppercase.

Specifying methods limits allowed HTTP methods to GET and POST.

5fill in blank

hard

Fill all three blanks to create a CORS config that allows origin 'https://site.com', credentials, and only GET method.

Express

app.use(cors({ origin: '[1]', credentials: [2], methods: ['[3]'] }));

Drag options to blanks, or click blank then click option'

Ahttps://site.com

BTrue

CGET

DPOST

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'true' as a string for credentials.

Using wrong origin URL or method names in lowercase.

This config allows only 'https://site.com' origin, sends credentials, and permits only GET requests.