The Complete Production SOP: How to Deploy and Run CORS Access-Control Hardening & Preflight Checks in Autonomous AI Agents

---
name: "cors-origin-preflight-hardening"
description: "Configure secure Cross-Origin Resource Sharing (CORS) without wildcards or leaks."
metadata:
  author: "MDN Web Docs"
  version: "1.0.0"
  runtime_compatibility:
    - "codex"
    - "claude-code"
    - "cursor"
    - "windsurf"
triggers:
  - "configure cors allowlist"
  - "fix cors preflight error"
  - "prevent insecure cors wildcard"
permissions:
  fs_read: true
  fs_write: "workspace"
  shell_exec: false
  net_access: false
---

# CORS Access-Control Hardening & Preflight Checks
Configures production CORS policies: exact origin matching, validating Origin headers against dynamic allowlists, handling OPTIONS preflights, and preventing Access-Control-Allow-Origin: * with credentials.

## Execution SOP & Rules
1. Match incoming Origin headers against an explicit array of allowed domain strings.
2. Never return Access-Control-Allow-Origin: * when Access-Control-Allow-Credentials is true.
3. Include Vary: Origin in responses when dynamically reflecting allowed origins.
4. Limit Access-Control-Allow-Headers and Access-Control-Allow-Methods strictly to required values.

const rawOrigins = process.env.CORS_ALLOWED_ORIGINS || '';
export const ALLOWED_ORIGINS: ReadonlySet<string> = new Set(
  rawOrigins.split(',').map((o) => o.trim()).filter(Boolean)
);

export function isOriginAllowed(origin: string | undefined): boolean {
  if (!origin) return false;
  return ALLOWED_ORIGINS.has(origin);
}

import { Request, Response, NextFunction } from 'express';
import { isOriginAllowed } from '../config/cors';

export function hardenedCors(req: Request, res: Response, next: NextFunction): void {
  const origin = req.headers.origin;

  if (origin && isOriginAllowed(origin)) {
    res.setHeader('Access-Control-Allow-Origin', origin);
    res.setHeader('Access-Control-Allow-Credentials', 'true');
    res.setHeader('Vary', 'Origin');
  }

  res.setHeader('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE, OPTIONS');
  res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Authorization, X-Requested-With');
  res.setHeader('Access-Control-Max-Age', '86400');

  if (req.method === 'OPTIONS') {
    res.status(204).end();
    return;
  }

  next();
}

import request from 'supertest';
import app from '../src/app';

describe('Hardened CORS Middleware', () => {
  it('reflects authorized origin and appends Vary header', async () => {
    const res = await request(app)
      .get('/api/health')
      .set('Origin', 'https://app.example.com');
    expect(res.headers['access-control-allow-origin']).toBe('https://app.example.com');
    expect(res.headers['access-control-allow-credentials']).toBe('true');
    expect(res.headers['vary']).toContain('Origin');
  });

  it('rejects unauthorized origin from CORS headers', async () => {
    const res = await request(app)
      .get('/api/health')
      .set('Origin', 'https://malicious-site.com');
    expect(res.headers['access-control-allow-origin']).toBeUndefined();
  });

  it('handles OPTIONS preflight with 204 status', async () => {
    const res = await request(app)
      .options('/api/health')
      .set('Origin', 'https://app.example.com')
      .set('Access-Control-Request-Method', 'POST');
    expect(res.status).toBe(204);
    expect(res.headers['access-control-allow-methods']).toContain('POST');
  });
});