boolean | import('cors').CorsOptions>= 1.1.11Configure CORS options for the dev server or preview server, based on the cors middleware.
object:Enable CORS with the specified options.true:Enable CORS with default options (allow all origins, not recommended).false:Disable CORS.
Using cors: true or cors.origin: '*' exposes your dev server to all origins and can compromise your source code security. We recommend using the origin option to specify an allowlist of trusted origins instead.
The cors option can be an object, which is the same as the cors middleware options.
The default configuration is the equivalent of:
The origin option is used to configure the Access-Control-Allow-Origin header:
Specify multiple allowed origins using an array:
Use a regular expression to allow all matching origins:
Setting origin to a function allows you to dynamically determine the allowed origin, the function receives two parameters:
origin:The origin of the incoming request, undefined if no origin is present.callback:A function to set the allowed origin.