So, headers only returned for OPTIONS request... again?

[smff]

So, headers only returned for OPTIONS request... again?

[HugoPoi]

Same for problem for me. Using app.use(cors()); do nothing.
After digging during 2 hours, I figure out why I can't have CORS header on GET/POST/PUT....
First, CORS OPTIONS pre-flight works as expected with app.options(*, cors());
Second, when i use app.get('/test', cors(), function(req, res){res.json("Message with cors")}) works as expected.
My setup use Express 3.x and use app.use(app.router); before app.use(cors());. This register all middlewares behind this line after the request being handled.
Just place app.use(cors()); before app.use(app.router); or remove app.use(app.router);

[rkyleg]

Thanks @HugoPoi, that was my problem as well.

[stouf]

I took a look at the code and this behavior is apparently intended:

if (method === 'OPTIONS') {
      // preflight
      headers.push(configureOrigin(options, req));
      headers.push(configureCredentials(options, req));
      headers.push(configureMethods(options, req));
      headers.push(configureAllowedHeaders(options, req));
      headers.push(configureMaxAge(options, req));
      headers.push(configureExposedHeaders(options, req));
      applyHeaders(headers, res);

      if (options.preflightContinue ) {
        next();
      } else {
        res.statusCode = options.optionsSuccessStatus || defaults.optionsSuccessStatus;
        res.end();
      }
    } else {
      // actual response
      headers.push(configureOrigin(options, req));
      headers.push(configureCredentials(options, req));
      headers.push(configureExposedHeaders(options, req));
      applyHeaders(headers, res);
      next();
    }
  }

It also seems to be part of the standard definition. According to MDN, some headers like Access-Control-Max-Age and Access-Control-Allow-Methods for example will only be used for preflight requests.

The Access-Control-Max-Age header indicates how long the results of a preflight request can be cached. For an example of a preflight request, see the above examples.

The Access-Control-Allow-Methods header specifies the method or methods allowed when accessing the resource. This is used in response to a preflight request. The conditions under which a request is preflighted are discussed above.

Some others however (like Access-Control-Allow-Origin and Access-Control-Allow-Credentials for example) will be used for every request, regardless of the HTTP method.