I have random 'Access-Control-Allow-Origin' errors, even if i set origin: '*', is my usage correct ?

[zeid0ne]

I have random 'Access-Control-Allow-Origin' errors, even if i set origin: '*', is my usage correct ?

[jonchurch]

the package's responsibility ends after its middleware finishes running. what happens between then and logging the headers in the browser can be influenced by an excitingly large number of things. if you create a minimal repro that points to cors as a likely culprit, we can dig in further

start here though to save yourself some sanity if this is still an active issue for you

✨

const express = require('express');
const cors = require('cors');
const app = express();

app.use(cors({
  exposedHeaders: ['Patient-Sequence-Number', 'Professional-Sequence-Number']
}));
// put this middleware immediately after registering the cors middleware
app.use((req, res, next) => {
  console.log('Headers after CORS middleware:', res.getHeaders());
  next();
});

// Wrapping res.send to log before sending the response
const originalSend = res.send;
res.send = function(...args) {
  console.log('Headers before sending response:', this.getHeaders());
  originalSend.apply(this, args);
};

app.get('/api-health-check', function (req, res) {
  try {
    res.sendStatus(200);
  } catch (e) {
    return res.status(503).send('API health check error ' + e);
  }
});

app.listen(3000, () => {
  console.log('Server is running on port 3000');
});

[gdbjohnson]

I've found that when I have an array for the origin, the Access-Control-Allow-Origin header is missing. when it is a single valued string, it is there

[jonchurch]

Can reopen if we get more info that points to an issue