CORS configuration in Node.js - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

What does CORS stand for and why is it important?

Choose the correct explanation of CORS and its purpose in web development.

A Cross-Origin Resource Sharing; it allows web pages to request resources from different domains securely.

B Cross-Origin Request Security; it blocks all requests from other domains by default.

C Cross-Origin Resource Sharing; it disables all security checks for requests between domains.

D Cross-Origin Request Sharing; it encrypts data sent between different domains.

💡 Hint

Think about how browsers handle requests from one website to another domain.

CORS stands for Cross-Origin Resource Sharing. It is a security feature that allows controlled access to resources on a web server from a different domain than the one serving the web page. This prevents malicious sites from reading sensitive data from another domain.

❓ component_behavior

intermediate

What is the output when this Node.js Express server handles a cross-origin request?

Given the following Express server code with CORS configured, what will the browser receive when a request comes from http://example.com?

Node.js

import express from 'express';
import cors from 'cors';

const app = express();

app.use(cors({ origin: 'http://example.com' }));

app.get('/', (req, res) => {
  res.json({ message: 'Hello World' });
});

app.listen(3000);

A The browser receives the JSON response but without any CORS headers, so access is blocked.

B The server throws an error because the origin is hardcoded.

C The browser receives a 404 Not Found error.

D The browser receives the JSON response with CORS headers allowing access from http://example.com.

💡 Hint

Check how the cors middleware is configured and what it does.

The cors middleware adds the appropriate headers to allow requests from http://example.com. The server responds with the JSON and the browser accepts it because the origin matches.

📝 Syntax

advanced

Which option correctly configures CORS to allow multiple specific origins in Express?

Choose the code snippet that correctly allows CORS requests from http://site1.com and http://site2.com only.

A app.use(cors({ origin: '*http://site1.com*|*http://site2.com*' }));

B app.use(cors({ origin: ['http://site1.com', 'http://site2.com'] }));

C app.use(cors({ origin: function(origin, callback) { if(['http://site1.com', 'http://site2.com'].includes(origin)) callback(null, true); else callback(new Error('Not allowed')); } }));

D app.use(cors({ origin: 'http://site1.com,http://site2.com' }));

💡 Hint

The cors package supports arrays for the origin option.

Option B is correct because the cors middleware supports an array of strings directly for the origin option to allow multiple specific origins only. Option B treats the comma-separated value as a single origin. Option B uses Error which propagates an error to the next middleware instead of cleanly denying. Option B uses invalid format.

🔧 Debug

advanced

Why does this CORS configuration cause a runtime error?

Examine the code below. Why does the server crash when starting?

Node.js

import express from 'express';
import cors from 'cors';

const app = express();

app.use(cors({ origin: true }));

app.listen(3000);

A The server crashes because the port 3000 is already in use.

B The server crashes because the cors package is not imported correctly.

C The origin option set to true is valid and does not cause a crash.

D The value true for origin is invalid and causes a TypeError at runtime.

💡 Hint

Check the documentation for the cors package about the origin option.

Setting origin to true in the cors middleware allows requests from any origin. This is valid and does not cause a runtime error. The server crash must be caused by something else, but none of the other options match the code given.

❓ state_output

expert

What is the value of the Access-Control-Allow-Origin header for this request?

Given this Express server code and a request from http://evil.com, what will be the value of the Access-Control-Allow-Origin header in the response?

Node.js

import express from 'express';
import cors from 'cors';

const allowedOrigins = ['http://good.com', 'http://friend.com'];

const app = express();

app.use(cors({
  origin: (origin, callback) => {
    if (!origin) return callback(null, true);
    if (allowedOrigins.includes(origin)) {
      callback(null, origin);
    } else {
      callback(null, false);
    }
  }
}));

app.get('/', (req, res) => {
  res.send('Hello');
});

app.listen(3000);

A undefined (no Access-Control-Allow-Origin header)

B "*"

C "http://evil.com"

D "http://good.com"

💡 Hint

Consider what happens when the origin is not in the allowed list and how the callback is called.

If the origin is not in the allowedOrigins list, the callback is called with false, which means no CORS headers are set. Therefore, the Access-Control-Allow-Origin header is not included in the response.

Practice

1. What is the main purpose of configuring CORS in a Node.js server?

easy

A. To speed up server response time

B. To control which websites can access server resources

C. To encrypt data sent between client and server

D. To manage database connections

Solution

1. Step 1: Understand CORS role

   CORS (Cross-Origin Resource Sharing) controls which external websites can request resources from your server.

2. Step 2: Identify main purpose

   It is not about speed, encryption, or database management but about access control from different origins.

3. Final Answer:

   To control which websites can access server resources -> Option B

4. Quick Check:

   CORS controls access = A [OK]

Hint: Remember CORS = Cross-Origin Resource Sharing control [OK]

Common Mistakes:

• Confusing CORS with encryption or speed optimization
• Thinking CORS manages databases
• Assuming CORS is a security firewall

2. Which of the following is the correct way to import and use the cors middleware in an Express app?

easy

A. import cors from 'cors'; app.use(cors());

B. import cors from 'cors'; app.use(cors);

C. const cors = require('cors'); app.use(cors);

D. const cors = require('cors'); app.use(cors());

Solution

1. Step 1: Identify modern import syntax

   Using ES modules, the correct import is import cors from 'cors';.

2. Step 2: Use middleware correctly

   Middleware must be called as a function: app.use(cors()); not just cors.

3. Final Answer:

   import cors from 'cors'; app.use(cors()); -> Option A

4. Quick Check:

   Import + call middleware = D [OK]

Hint: Use import + call cors() as function [OK]

Common Mistakes:

• Forgetting parentheses when using middleware
• Mixing require and import syntax
• Using app.use(cors) without parentheses

3. Given this code snippet, what will be the CORS behavior?

import express from 'express';
import cors from 'cors';
const app = express();
app.use(cors({ origin: 'https://example.com' }));
app.get('/', (req, res) => res.send('Hello'));
app.listen(3000);

medium

A. Only requests from https://example.com will be allowed

B. Requests from any origin will be allowed

C. No requests will be allowed due to missing headers

D. Requests from localhost will be allowed only

Solution

1. Step 1: Analyze the origin option

   The cors middleware is configured with origin: 'https://example.com', which restricts access to that origin only.

2. Step 2: Understand effect on requests

   Requests from other origins will be blocked by CORS policy, so only https://example.com is allowed.

3. Final Answer:

   Only requests from https://example.com will be allowed -> Option A

4. Quick Check:

   origin restricts access = C [OK]

Hint: Check origin value to know allowed sites [OK]

Common Mistakes:

• Assuming all origins allowed by default
• Confusing origin with methods or headers
• Thinking localhost is allowed without explicit mention

4. Regarding this CORS setup code, which statement is accurate?

import express from 'express';
import cors from 'cors';
const app = express();
app.use(cors({ origin: ['https://site1.com', 'https://site2.com'] }));
app.listen(3000);

medium

A. Missing call to cors() function

B. The app.listen() call is missing a callback

C. The origin option can be an array

D. The cors package is not imported correctly

Solution

1. Step 1: Check origin option type

   The origin option in cors accepts an array directly for multiple static origins; it also supports string, boolean, regex, or function.

2. Step 2: Confirm other parts are correct

   The cors() function is called correctly, app.listen() works without callback, and import syntax is valid.

3. Final Answer:

   The origin option can be an array -> Option C

4. Quick Check:

   origin array valid = B [OK]

Hint: origin can be string, array, regex, or function [OK]

Common Mistakes:

• Thinking origin cannot accept an array
• Forgetting to call cors() as a function
• Thinking app.listen needs a callback always

5. You want to allow CORS requests only from https://trusted.com and http://localhost:3000. Which is the best way to configure the cors middleware in your Node.js app?

hard

A. Use origin as a function to check allowed origins dynamically

B. Set origin to '*' to allow all origins

C. Disable CORS middleware and handle manually

D. Set origin to an array of allowed origins directly

Solution

1. Step 1: Understand multiple origins handling

   The cors package accepts an array directly for origin with a static list of allowed origins. This is the simplest and best approach here.

2. Step 2: Evaluate options

   Use function for dynamic logic (e.g., regex or env-based). '*' allows all (insecure). Manual handling is error-prone and not recommended.

3. Final Answer:

   Set origin to an array of allowed origins directly -> Option D

4. Quick Check:

   Static multiple origins use array = C [OK]

Hint: Use array for static multiple origins [OK]

Common Mistakes:

• Using '*' to allow all origins insecurely
• Using a single string for multiple origins
• Disabling middleware instead of configuring properly