Acheiving CORS via a Node HTTP Server

cors.js

// Create our server
var server;
server = http.createServer(function(req,res){
	// Set CORS headers
	res.setHeader('Access-Control-Allow-Origin', '*');
	res.setHeader('Access-Control-Request-Method', '*');
	res.setHeader('Access-Control-Allow-Methods', 'OPTIONS, GET');
	res.setHeader('Access-Control-Allow-Headers', '*');
	if ( req.method === 'OPTIONS' ) {
		res.writeHead(200);
		res.end();
		return;
	}

	// ...
});

I just tried this and apparently * is not permitted for the Access-Control-Allow-Headers header.

If * is not permitted, what should be used then? Thanks

+1. saved an hour.

You need to just allow origin:

res.setHeader('Access-Control-Allow-Headers', req.header.origin);

Failing that:

If you using Chrome and your not sure what headers are being requested, use the Developer Console, Network select the call being made and you can view what headers are being requested by Access-Control-Request-Headers

(http://stackoverflow.com/questions/32500073/request-header-field-access-control-allow-headers-is-not-allowed-by-itself-in-pr)

e.g.:
res.setHeader('Access-Control-Allow-Headers', 'authorization, content-type');

@michaellujan
for reference, req contains headers, not header.

Thanks

thanks <3

Thanks a lot!

Thanks!!!

My appreciation!

Thanks!

Actually there is $ http-server --cors which works nice for me.

Bro muchas gracias me funcionó a la perfeccion he estado buscando la solucion del cors de forma nativa en node desde hace mucho, no me gusta usar tantas dependencias, en serio muchas gracias

Seven years later and this has saved me a day.

The most important aspect of what differentiates this code from most stackoverflow answers / blogposts is that it returns these headers both on the prefetch response to the OPTIONS request, and on the actual response delivering the requested data.

Failing that:

If you using Chrome and your not sure what headers are being requested, use the Developer Console, Network select the call being made and you can view what headers are being requested by Access-Control-Request-Headers

(http://stackoverflow.com/questions/32500073/request-header-field-access-control-allow-headers-is-not-allowed-by-itself-in-pr)

e.g.: res.setHeader('Access-Control-Allow-Headers', 'authorization, content-type');

This did it, finally. Thanks +1(000)!