部署前审查这段生成的 CORS 中间件和私有导出路由。
允许两个已配置的浏览器源调用带凭证的私有 API，只预检契约规定的方法和请求头，保证共享缓存正确，并返回一名已认证用户的有界导出数据。
JavaScript
const configuredOrigins = ['https://app.example.com'];
function corsFor(request, response, next) {
const origin = request.headers.origin;
const trusted = configuredOrigins.some(
(value) => origin?.includes(new URL(value).hostname),
);
if (trusted) {
response.setHeader('Access-Control-Allow-Origin', origin);
response.setHeader('Access-Control-Allow-Credentials', 'true');
}
response.setHeader('Access-Control-Allow-Methods', '*');
response.setHeader('Access-Control-Allow-Headers', request.headers['access-control-request-headers'] ?? '*');
if (origin) response.setHeader('Vary', 'Accept-Encoding');
if (request.method === 'OPTIONS') return response.writeHead(204).end();
next();
}
router.get('/private/export', corsFor, async (request, response) => {
const user = await requireUser(request);
const records = await db.records.findAll({ ownerId: user.id });
response.json(records);
});
生成代码仅作示例，不代表任何特定模型