# How to Enable CORS in Express Using the npm cors Middleware

> Enable CORS in your Express app easily with the npm cors middleware. Install and register cors to automatically add Access Control Allow Origin headers to every response.

- Repository: [expressjs/express](https://github.com/expressjs/express)
- Tags: how-to-guide
- Published: 2026-02-12

---

**Install the `cors` package and register it with `app.use(cors())` before your route handlers to automatically inject the required `Access-Control-Allow-Origin` headers into every response.**

The Express framework (expressjs/express) handles cross-origin requests through its middleware pipeline defined in [`lib/application.js`](https://github.com/expressjs/express/blob/main/lib/application.js). When you launch your application via `npm start`, adding the **cors** middleware early in the stack ensures that all incoming requests receive the proper HTTP headers to communicate with browsers on different origins.

## Install the cors Package

Add the official middleware to your project before configuring your server.

```bash
npm install cors

```

This package provides a thin, well-tested wrapper that sets the appropriate `Access-Control-*` response headers based on your configuration options.

## Enable CORS Globally for All Routes

The most common approach is to register the middleware at the application level using `app.use()`. According to the Express source in [`lib/application.js`](https://github.com/expressjs/express/blob/main/lib/application.js), this method mounts the middleware function so it executes for every incoming request before reaching your route handlers.

```javascript
const express = require('express');
const cors = require('cors');

const app = express();

// Register cors middleware first in the stack
app.use(cors());

// Subsequent middleware and routes
app.use(express.json());
app.get('/api/data', (req, res) => {
  res.json({ status: 'accessible from any origin' });
});

app.listen(3000, () => {
  console.log('Server running on port 3000');
});

```

With this default configuration, every response includes `Access-Control-Allow-Origin: *`, allowing requests from any domain.

## Configure Specific Origins and Methods

For production applications, restrict access to known domains rather than allowing all origins.

```javascript
const corsOptions = {
  origin: ['https://example.com', 'https://app.example.com'],
  methods: ['GET', 'POST', 'PUT'],
  allowedHeaders: ['Content-Type', 'Authorization'],
  credentials: true
};

app.use(cors(corsOptions));

```

This setup inspects the `Origin` header of each request. Only browsers sending requests from the specified domains receive the CORS headers; others are blocked by the browser's same-origin policy.

## Apply CORS to Specific Routes Only

You can apply different CORS rules to individual endpoints while keeping a global default. This pattern leverages the middleware architecture in [`lib/express.js`](https://github.com/expressjs/express/blob/main/lib/express.js) where functions can be mounted on specific paths.

```javascript
// Global: allow any origin on public routes
app.use(cors());

app.get('/public', (req, res) => {
  res.json({ data: 'public information' });
});

// Private: restrict to single origin
const privateCors = cors({ origin: 'https://admin.internal.com' });
app.get('/admin', privateCors, (req, res) => {
  res.json({ data: 'sensitive information' });
});

```

The `privateCors` function executes only for requests matching `/admin`, leaving other routes unaffected by its specific headers.

## Understanding the Middleware Architecture

Express's core design centers on a middleware stack implemented in [`lib/application.js`](https://github.com/expressjs/express/blob/main/lib/application.js). When you call `app.use(cors())`, the application pushes your middleware function into an internal array that processes requests sequentially.

As the request flows through the stack:

1. Express creates `req` and `res` objects.
2. The `cors()` middleware inspects the request, adds the necessary headers to `res`, and calls `next()`.
3. Control passes to subsequent middleware or route handlers.
4. The final handler sends the response with CORS headers already attached.

Because `cors()` automatically handles pre-flight `OPTIONS` requests, you do not need to implement separate logic for the browser's preliminary security checks.

## Running Your Application with npm start

In the expressjs/express repository, the default `npm start` command executes `node ./examples/web-service/index.js`. Regardless of your specific entry point, ensure your application initializes the middleware before starting the server.

Update your [`package.json`](https://github.com/expressjs/express/blob/main/package.json) scripts section:

```json
{
  "scripts": {
    "start": "node index.js"
  }
}

```

Then structure your entry file to mount `cors()` before route definitions:

```javascript
// index.js
const express = require('express');
const cors = require('cors');
const app = express();

// Critical: cors must come before route definitions
app.use(cors());

app.get('/', (req, res) => {
  res.json({ message: 'CORS enabled across all origins' });
});

const PORT = process.env.PORT || 3000;
app.listen(PORT, () => {
  console.log(`Server listening on port ${PORT}`);
});

```

Execute the following to launch:

```bash
npm install
npm start

```

Visiting your endpoint from a browser on a different origin (or using a tool like `curl` with the `-H "Origin: http://example.com"` flag) will now succeed because the middleware injects the required headers before the response is sent.

## Summary

- **Install** the `cors` package via npm to add CORS functionality to your Express application.
- **Register early** using `app.use(cors())` in [`lib/application.js`](https://github.com/expressjs/express/blob/main/lib/application.js)'s middleware stack to ensure all routes inherit the headers.
- **Configure origins** by passing an options object to restrict access to specific domains rather than using the wildcard `*`.
- **Handle pre-flight** requests automatically without writing separate `OPTIONS` route handlers.
- **Test with npm start** by placing the middleware initialization in your entry file before route definitions and the `app.listen()` call.

## Frequently Asked Questions

### What does the cors middleware actually modify in the request-response cycle?

The cors middleware intercepts outgoing responses in the middleware chain defined in [`lib/application.js`](https://github.com/expressjs/express/blob/main/lib/application.js) and appends HTTP headers like `Access-Control-Allow-Origin` and `Access-Control-Allow-Methods` to the `res` object. It also automatically terminates the request-response cycle for `OPTIONS` pre-flight requests by sending the appropriate headers immediately, preventing unnecessary processing by subsequent route handlers.

### Why must I place app.use(cors()) before my route definitions?

Express executes middleware in the exact order registered via `app.use()` as implemented in [`lib/application.js`](https://github.com/expressjs/express/blob/main/lib/application.js). If you mount routes before the cors middleware, those route handlers will send responses before the CORS headers are attached, causing browsers to block cross-origin requests. Registering `cors()` first ensures the headers are present before any response is transmitted.

### Can I enable CORS for only one specific route while disabling it for others?

Yes. Instead of using `app.use(cors())` globally, pass the cors middleware directly to the specific route method: `app.get('/api', cors(), handler)`. This mounts the middleware only on that specific path, leaving other routes without CORS headers. You can also apply different `cors` configurations with distinct options objects to different endpoints to vary security levels across your API.

### How do I handle credentials when using the cors package?

Set the `credentials: true` option in your configuration and specify an explicit origin (never `*` when credentials are involved). Browsers reject wildcard origins when credentials are included. Your configuration should resemble `{ origin: 'https://trusted.com', credentials: true }`. The middleware will then set the `Access-Control-Allow-Credentials: true` header, permitting cookies and authorization headers to cross origin boundaries.