CORS configuration in Node.js - Cheat Sheet & Quick Revision

Recall & Review

beginner

What does CORS stand for and why is it important in web development?

CORS stands for Cross-Origin Resource Sharing. It is important because it controls how resources on a web server can be requested from another domain, helping to keep web applications secure by preventing unauthorized access.

beginner

How do you enable CORS in a Node.js Express app using the 'cors' package?

You install the 'cors' package and then use it as middleware in your Express app like this: <br><code>const cors = require('cors');<br>app.use(cors());</code><br>This allows all cross-origin requests by default.

intermediate

What is the purpose of setting specific origins in CORS configuration?

Setting specific origins restricts which domains can access your server resources. This improves security by only allowing trusted websites to make requests.

intermediate

Explain the difference between simple requests and preflight requests in CORS.

Simple requests are basic HTTP requests that browsers allow without extra checks. Preflight requests are OPTIONS requests sent by the browser to check if the actual request is safe to send, used for methods like PUT or DELETE or when custom headers are involved.

intermediate

How can you configure CORS in Express to allow only GET and POST methods from 'https://example.com'?

You can configure CORS like this:<br>app.use(cors({<br> origin: 'https://example.com',<br> methods: ['GET', 'POST']<br>}));<br>This restricts access to only GET and POST requests from that origin.

What does the 'Access-Control-Allow-Origin' header do?

A Specifies which origins can access the resource

B Blocks all cross-origin requests

C Encrypts data sent between client and server

D Specifies the HTTP methods allowed

The 'Access-Control-Allow-Origin' header tells the browser which origins are allowed to access the resource.

Which HTTP method is used for CORS preflight requests?

A OPTIONS

B POST

C GET

D PUT

Browsers send an OPTIONS request as a preflight to check if the actual request is safe.

In Express, which package is commonly used to handle CORS?

A express-cors

B cors-handler

C cross-origin

D cors

The 'cors' package is the standard middleware to enable CORS in Express apps.

What happens if you do not configure CORS on your server?

A All cross-origin requests are allowed by default

B Your server sends an error response

C Browsers block cross-origin requests by default

D Your server crashes

Browsers block cross-origin requests unless the server explicitly allows them via CORS headers.

Which of these is NOT a valid CORS configuration option in the 'cors' package?

A methods

B encryption

C credentials

D origin

'encryption' is not a CORS configuration option; CORS deals with access control, not encryption.

Describe how to set up CORS in a Node.js Express app to allow only requests from 'https://myapp.com' and only GET and POST methods.

Think about the options object passed to the cors middleware.

Explain why browsers use preflight requests and how they relate to CORS configuration.

Consider what happens before the main request is sent.