"Access-Control-Allow-Origin" is not added to headers

It started with having problem for CORS between my front-end (angular2) and back-end (expressjs). Some StackOverflow recommend to use cors-package (for answers in 2016 against those from 2013-2014).

I’ve used following configuration and CORS still not adding “Access-Control-Allow-Origin”:

cors            = require('cors'),

const originsWhiteList = {
  "http://localhost:3001": true   // front-end development port
};

const corsOptions = {
  origin: function(origin, callback) {
    callback(originsWhiteList[origin] ? null : 'Bad Request', originsWhiteList[origin]);
  },
  credentials: true,
  methods: ['GET', 'POST', 'PUT', 'DELETE']
}
.
.
.
// just right before other routes
app.use(cors(corsOptions));
app.options('/api/v1/*', cors());

this should be classified as bug, right ?

the exact error:

XMLHttpRequest cannot load http://localhost:3000/api/v1/todos. No ‘Access-Control-Allow-Origin’ header is present on the requested resource. Origin ‘http://localhost:3001’ is therefore not allowed access. The response had HTTP status code 403.

[nahwinrajan]

Function - set origin to a function implementing some custom logic. The function takes the request origin as the first parameter and a callback (which expects the signature err [object], allow [bool]) as the second.

the readme file state the second callback’s parameter is a boolean

[dougwilson]

So after spending the past week getting to know this module better to help maintain it–it turns out that both are correct. The second argument you give to the callback can actually be any valid value to the origin option (so, an array, a string, a boolean, etc.).