Update documentation regarding preflight use with other middleware

I’ve run into an issue when using a combination of middleware, particularly ones that modify the headers. As it turns out, ordering is important.

import express from 'express'
import helmet from 'helmet'
import cors from 'cors'
import morgan from 'morgan'
import bodyParser from 'body-parser'
import router from './routes'
import './utils/db'

const app = express()

app.use(cors())
app.use(morgan('combined'))
app.use(bodyParser.json({ type: 'application/json' }))
app.use(helmet())

app.use(router)

let port = 5000

app.listen(port, () => {
  console.log('ready')
})

Stumbled onto this issue which reveals the issue is in this cors middleware. https://github.com/helmetjs/helmet/issues/157

Digging through the source code for cors, the following line prevents subsequent middleware from being used for the preflight:

https://github.com/expressjs/cors/blob/b5bbc285194568f414afc2390c56f672734d3fac/lib/index.js#L180

I understand that this is required, but it’s unclear that the ordering of middleware is important.

I think it’s worth adding either a known issues section, or making it clear under usage.

[raine]

Understood. In that case I would certainly clarify in the README that app.use(cors()) will enable CORS preflight requests. Currently the “Enabling CORS Pre-Flight” section leaves you under the impression that app.options() is the only way.

[jub0bs]

I think this confusion stems from the middleware incorrectly interpreting all OPTIONS requests as preflight requests. But clearly, some OPTIONS requests are not preflight requests.