Express CORS子域

Question

I have a site — https://example.com — that makes calls to an API — https://api.example.com —. The API is written in Express, and its using CORS package to allow the requests from the site:

app.use(
    cors({
        credentials: true,
        origin: "https://example.com",
    })
);

The site can be accessed via https://example.com or via https://www.example.com . As you see, in the API am allowing explicitly the requests coming from the former address, but not from the latter. So if anyone access it via the latter address the requests to the API will be rejected.

What is the usual way to solve that? Allow explicitly both https://example.com and https://www.example.com ? Or maybe there is a way to ignore the subdomain www ?

Thanks in advance!

--

EDIT:

As proposed I added https://www.example.com explicitly to the cors configuration

app.use(
    cors({
        credentials: true,
        origin: ["https://example.com", "https://www.example.com"],
    })
);

But this didn't work. As a workaround what I just did is to redirect with a rewrite condition in .htaccess file —Apache server— from www domain to non www domain.

But the question now is: why even allowing www.example.com didnt work? Is there any common reason for that?

Answer 1

The usual way would be to avoid having two websites on different origins with identical content.

Configure www.example.com to issue an HTTP 301 redirect to example.com .

---

Allow explicitly both https://example.com and https://www.example.com ?

That would work too. origin can be passed an array.

Or maybe there is a way to ignore the subdomain www?

origin can also be passed a regular expression.

Answer 2

You need to allow both domains. The API for doing this is a bit complicated. Basically you need to read the documentation of the CORS package :

app.use(
    cors({
        credentials: true,
        origin: function (origin callback) {
            switch (origin) {
                case "https://example.com":
                case "https://www.example.com":
                    callback(null, true); // allow these domains
                    break;
                default:
                    callback(new Error('Now allowed')); // block others
            }
        },
    })
);

The value of origin can only be either a string or your own custom logic implemented as a function.