Add support for having specified domain instead of wildcard

[dani2819]

Add support for having specified domain instead of wildcard

[pinko-fowle]

I was digging through MDN docs on CORS, and happened to notice a specific CORS error that suggests an extra-partiuclar reason something like this might be useful:

"Reason: Credential is not supported if the CORS header 'Access-Control-Allow-Origin' is '*"
https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS/Errors/CORSNotSupportingCredentials

That would make something like this handy.

In the meantime, a second handler after the fact should help workaround this:

app.use(function setSpecificOrigin(req, res, next) {
  if (res.get('access-control-allow-origin') === '*') {
    res.set('access-control-allow-origin', req.get('origin'))
  }
  next()
})

[dougwilson]

Hi, yes, it is a dance with the sec researchers, as they do want things to be secure, but also want cves under their name.

And yes, if the response header of access-control-allow-origin is an asterisk to a preflight request, then a cors based client makes the second, real request it will not include credentials (cookie and authentication headers) with it, even if access-control-allow-credentials is true.

[dougwilson]

If you want credentials to work from any origin, this module you can set origin: true to reflect the origin instead of using '*' https://github.com/expressjs/cors?tab=readme-ov-file#configuration-options