bext-plugin-cors

CORS middleware with wildcard patterns and preflight caching.

Configurable CORS middleware. Handles preflight requests, credentials, exposed headers, and wildcard origin patterns. Preflight responses are cached to reduce roundtrips.

Install

bext plugin add cors

Config

[plugins.cors]
origins = ["https://app.example.com", "https://*.example.com"]
methods = ["GET", "POST", "PUT", "DELETE"]
headers = ["Content-Type", "Authorization"]
credentials = true
max_age = 86400

Wildcard patterns

Origins support `*` wildcards: `https://*.example.com` matches `https://app.example.com` and `https://staging.example.com` but not `https://evil.com`.

Set `origins = ["*"]` to allow all origins (not recommended with `credentials = true`).

Per-route overrides

You can override CORS settings per route by exporting a `cors` object from your route handler:

export const cors = {
  origins: ["https://specific-app.com"],
  methods: ["GET"],
};