CORS configuration in NestJS - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to enable CORS in a NestJS application.

NestJS

const app = await NestFactory.create(AppModule);
app.[1]();
await app.listen(3000);

Drag options to blanks, or click blank then click option'

AenableCors

BstartCors

CuseCors

DactivateCors

Attempts:

3 left

💡 Hint

Common Mistakes

Using methods like startCors or useCors which do not exist in NestJS.

Forgetting to call the method before app.listen.

In NestJS, enableCors() is the method to enable CORS support on the app instance.

2fill in blank

medium

Complete the code to allow CORS only from 'https://example.com'.

NestJS

const app = await NestFactory.create(AppModule);
app.enableCors({ origin: [1] });
await app.listen(3000);

Drag options to blanks, or click blank then click option'

A'https://example.com'

B'http://localhost:3000'

C'*'

D'https://myapp.com'

Attempts:

3 left

💡 Hint

Common Mistakes

Using '*' which allows all origins instead of restricting.

Using a wrong URL or protocol.

Setting origin to 'https://example.com' restricts CORS to that domain only.

3fill in blank

hard

Fix the error in this CORS configuration to allow credentials.

NestJS

app.enableCors({ origin: 'https://example.com', [1]: true });

Drag options to blanks, or click blank then click option'

AallowCredentials

BwithCredentials

Ccredentials

DenableCredentials

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'allowCredentials' or 'withCredentials' which are not valid options here.

Forgetting to set this option when credentials are needed.

The correct option to allow credentials in NestJS CORS config is credentials.

4fill in blank

hard

Fill both blanks to configure CORS to accept GET and POST methods from any origin.

NestJS

app.enableCors({ origin: [1], methods: [2] });

Drag options to blanks, or click blank then click option'

A'*'

B['GET', 'POST']

C['PUT', 'DELETE']

D'https://example.com'

Attempts:

3 left

💡 Hint

Common Mistakes

Using a specific origin instead of '*'.

Including methods not requested like PUT or DELETE.

Using '*' for origin allows all origins. Setting methods to ['GET', 'POST'] restricts allowed HTTP methods.

5fill in blank

hard

Fill all three blanks to configure CORS with origin 'https://app.com', allow credentials, and only allow PUT method.

NestJS

app.enableCors({ origin: [1], credentials: [2], methods: [3] });

Drag options to blanks, or click blank then click option'

A'https://app.com'

Btrue

C['PUT']

Dfalse

Attempts:

3 left

💡 Hint

Common Mistakes

Setting credentials to false or a string.

Using wrong method names or multiple methods.

Using wildcard origin instead of specific URL.

This configuration restricts CORS to 'https://app.com', allows credentials, and only permits PUT requests.

Practice

1. What is the main purpose of enabling CORS in a NestJS application?

easy

A. To encrypt data between client and server

B. To speed up the server response time

C. To manage database connections

D. To allow web browsers from specific origins to access the backend resources

Solution

1. Step 1: Understand CORS purpose

   CORS (Cross-Origin Resource Sharing) controls which websites can access backend resources from a different origin.

2. Step 2: Identify correct purpose in NestJS

   Enabling CORS in NestJS allows specific web origins to access the backend safely.

3. Final Answer:

   To allow web browsers from specific origins to access the backend resources -> Option D

4. Quick Check:

   CORS controls access by origin = C [OK]

Hint: CORS controls which websites can access your backend [OK]

Common Mistakes:

• Confusing CORS with encryption
• Thinking CORS speeds up server
• Mixing CORS with database management

2. Which of the following is the correct way to enable CORS with default settings in a NestJS app?

easy

A. app.setCors(true)

B. app.enableCors({ origin: '*' })

C. app.enableCors()

D. app.useCors()

Solution

1. Step 1: Recall NestJS CORS enabling method

   The official method to enable CORS is app.enableCors() without parameters for default settings.

2. Step 2: Check options for correctness

   Options B, C, and D are not valid NestJS methods or have incorrect syntax.

3. Final Answer:

   app.enableCors() -> Option C

4. Quick Check:

   Default CORS enable = app.enableCors() [OK]

Hint: Use app.enableCors() to enable CORS simply [OK]

Common Mistakes:

• Using incorrect method names like setCors or useCors
• Passing invalid parameters to enableCors
• Confusing CORS enabling with middleware usage

3. Given this NestJS code snippet, what will be the allowed origin for CORS?

app.enableCors({ origin: 'https://example.com' });

medium

A. Only https://example.com can access the backend

B. All websites can access the backend

C. No websites can access the backend

D. Only localhost can access the backend

Solution

1. Step 1: Analyze the origin option in enableCors

   The origin option is set to 'https://example.com', which restricts access to this exact origin.

2. Step 2: Understand CORS behavior with origin setting

   Only requests coming from 'https://example.com' will be allowed by CORS policy.

3. Final Answer:

   Only https://example.com can access the backend -> Option A

4. Quick Check:

   origin restricts access = B [OK]

Hint: Origin option limits access to specified URL only [OK]

Common Mistakes:

• Assuming origin '*' is default
• Thinking multiple origins allowed without array
• Confusing origin with methods or headers

4. Identify the error in this NestJS CORS configuration code:

app.enableCors({ origins: ['https://site1.com', 'https://site2.com'] });

medium

A. The array syntax is invalid for origins

B. The property 'origins' is incorrect; it should be 'origin'

C. enableCors does not accept any options

D. The URLs must be strings without 'https://'

Solution

1. Step 1: Check property name for allowed origins

   The correct property name is 'origin' (singular), not 'origins'.

2. Step 2: Confirm array usage for multiple origins

   Passing an array to 'origin' is valid to allow multiple origins.

3. Final Answer:

   The property 'origins' is incorrect; it should be 'origin' -> Option B

4. Quick Check:

   Correct property name is origin = A [OK]

Hint: Use 'origin' not 'origins' for CORS config [OK]

Common Mistakes:

• Using 'origins' instead of 'origin'
• Thinking enableCors rejects options
• Removing protocol from URLs

5. You want to allow CORS only for GET and POST methods from two specific domains: https://app1.com and https://app2.com. Which is the correct NestJS CORS configuration?

hard

A. app.enableCors({ origin: ['https://app1.com', 'https://app2.com'], methods: ['GET', 'POST'] });

B. app.enableCors({ origins: ['https://app1.com', 'https://app2.com'], methods: 'GET,POST' });

C. app.enableCors({ origin: '*', methods: ['GET', 'POST'] });

D. app.enableCors({ origin: ['https://app1.com', 'https://app2.com'], method: ['GET', 'POST'] });

Solution

1. Step 1: Verify property names and values

   The property for allowed origins is 'origin' (singular), and it accepts an array for multiple domains. The 'methods' property accepts an array of HTTP methods.

2. Step 2: Check each option for correctness

   app.enableCors({ origin: ['https://app1.com', 'https://app2.com'], methods: ['GET', 'POST'] }); uses correct property names and value types. app.enableCors({ origins: ['https://app1.com', 'https://app2.com'], methods: 'GET,POST' }); uses 'origins' (incorrect) and methods as a string (less preferred). app.enableCors({ origin: '*', methods: ['GET', 'POST'] }); allows all origins ('*'), which is not desired. app.enableCors({ origin: ['https://app1.com', 'https://app2.com'], method: ['GET', 'POST'] }); uses 'method' (singular), which is incorrect.

3. Final Answer:

   app.enableCors({ origin: ['https://app1.com', 'https://app2.com'], methods: ['GET', 'POST'] }); -> Option A

4. Quick Check:

   Correct keys and array values = D [OK]

Hint: Use 'origin' and 'methods' with arrays for multiple values [OK]

Common Mistakes:

• Using 'origins' instead of 'origin'
• Passing methods as comma string instead of array
• Using 'method' instead of 'methods'
• Allowing all origins with '*' when not intended