Review this generated CORS middleware and private export route before deployment.
Allow two configured browser origins to call a credentialed private API, preflight only the documented methods and headers, keep shared caches correct, and return one authenticated user's bounded export.
JavaScript
const configuredOrigins = ['https://app.example.com'];
function corsFor(request, response, next) {
const origin = request.headers.origin;
const trusted = configuredOrigins.some(
(value) => origin?.includes(new URL(value).hostname),
);
if (trusted) {
response.setHeader('Access-Control-Allow-Origin', origin);
response.setHeader('Access-Control-Allow-Credentials', 'true');
}
response.setHeader('Access-Control-Allow-Methods', '*');
response.setHeader('Access-Control-Allow-Headers', request.headers['access-control-request-headers'] ?? '*');
if (origin) response.setHeader('Vary', 'Accept-Encoding');
if (request.method === 'OPTIONS') return response.writeHead(204).end();
next();
}
router.get('/private/export', corsFor, async (request, response) => {
const user = await requireUser(request);
const records = await db.records.findAll({ ownerId: user.id });
response.json(records);
});
generated code is illustrative, not from any one model