CORS configuration in NestJS - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What is the effect of this CORS configuration in NestJS?

Consider this NestJS setup for CORS:

const app = await NestFactory.create(AppModule);
app.enableCors({
  origin: 'https://example.com',
  methods: 'GET,POST',
  credentials: true
});
await app.listen(3000);

What will happen if a browser tries to send a PUT request from https://example.com?

NestJS

const app = await NestFactory.create(AppModule);
app.enableCors({
  origin: 'https://example.com',
  methods: 'GET,POST',
  credentials: true
});
await app.listen(3000);

A The PUT request will be redirected to GET automatically.

B The PUT request will succeed because origin matches.

C The PUT request will succeed but credentials will be ignored.

D The PUT request will be blocked by CORS policy.

💡 Hint

Check which HTTP methods are allowed in the CORS config.

Only GET and POST methods are allowed by CORS. PUT is not allowed, so the browser blocks the request due to CORS policy.

📝 Syntax

intermediate

Which option correctly enables CORS for multiple origins in NestJS?

You want to allow CORS requests from 'https://site1.com' and 'https://site2.com'. Which code snippet correctly configures this?

A app.enableCors({ origin: /https:\/\/site[12]\.com/ });

B app.enableCors({ origin: 'https://site1.com, https://site2.com' });

C app.enableCors({ origin: ['https://site1.com', 'https://site2.com'] });

D app.enableCors({ origin: true });

💡 Hint

Check the type of the 'origin' option for multiple domains.

The 'origin' option accepts an array of allowed origins. Option C correctly uses an array.

🔧 Debug

advanced

Why does this NestJS CORS config cause all requests to fail?

Given this code:

app.enableCors({
  origin: (origin, callback) => {
    if (origin === 'https://allowed.com') {
      callback(null, true);
    } else {
      callback(new Error('Not allowed by CORS'));
    }
  }
});

All requests from any origin fail with CORS error. Why?

NestJS

app.enableCors({
  origin: (origin, callback) => {
    if (origin === 'https://allowed.com') {
      callback(null, true);
    } else {
      callback(new Error('Not allowed by CORS'));
    }
  }
});

A The callback must be called with false to deny, not an Error.

B The origin check is case-sensitive and fails for 'https://allowed.com'.

C The origin function must return a boolean, not use callback.

D The callback error should be null to deny access, not an Error object.

💡 Hint

Check how the callback signals denial in CORS origin function.

To deny CORS, callback should be called with (null, false). Passing an Error causes failure.

❓ state_output

advanced

What is the value of the 'Access-Control-Allow-Credentials' header with this config?

In NestJS, you configure CORS as:

app.enableCors({
  origin: 'https://client.com',
  credentials: false
});

What will be the value of the 'Access-Control-Allow-Credentials' header in the response?

NestJS

app.enableCors({
  origin: 'https://client.com',
  credentials: false
});

A The header will be 'Access-Control-Allow-Credentials: true'.

B The header will be missing (not sent).

C The header will be 'Access-Control-Allow-Credentials: false'.

D The header will be 'Access-Control-Allow-Credentials: null'.

💡 Hint

Check if the header is sent when credentials is false.

When credentials is false, the header is not included in the response.

🧠 Conceptual

expert

Which statement about NestJS CORS configuration is TRUE?

Select the true statement about how NestJS handles CORS configuration:

A Using a function for 'origin' allows dynamic origin validation per request.

B Setting 'origin' to true allows requests from any origin and sends credentials by default.

C The 'methods' option defaults to all HTTP methods if omitted.

D Setting 'credentials' to true automatically sets 'Access-Control-Allow-Origin' to '*'.

💡 Hint

Think about dynamic origin checks and default behaviors.

Using a function for 'origin' lets you check each request's origin dynamically and decide if allowed.