{
  "_args": [
    [
      "cors@https://registry.npmjs.org/cors/-/cors-2.7.1.tgz",
      "/Users/nw/flint/packages/flint"
    ]
  ],
  "_from": "cors@2.7.1",
  "_id": "cors@2.7.1",
  "_inCache": true,
  "_location": "/cors",
  "_phantomChildren": {},
  "_requested": {
    "name": "cors",
    "raw": "cors@https://registry.npmjs.org/cors/-/cors-2.7.1.tgz",
    "rawSpec": "https://registry.npmjs.org/cors/-/cors-2.7.1.tgz",
    "scope": null,
    "spec": "https://registry.npmjs.org/cors/-/cors-2.7.1.tgz",
    "type": "remote"
  },
  "_requiredBy": [
    "/"
  ],
  "_resolved": "https://registry.npmjs.org/cors/-/cors-2.7.1.tgz",
  "_shasum": "3c2e50a58af9ef8c89bee21226b099be1f02739b",
  "_shrinkwrap": null,
  "_spec": "cors@https://registry.npmjs.org/cors/-/cors-2.7.1.tgz",
  "_where": "/Users/nw/flint/packages/flint",
  "author": {
    "email": "troygoode@gmail.com",
    "name": "Troy Goode",
    "url": "https://github.com/troygoode/"
  },
  "bugs": {
    "url": "https://github.com/expressjs/cors/issues"
  },
  "contributors": [
    {
      "name": "Troy Goode",
      "email": "troygoode@gmail.com",
      "url": "https://github.com/troygoode/"
    }
  ],
  "dependencies": {
    "vary": "^1"
  },
  "description": "middleware for dynamically or statically enabling CORS in express/connect applications",
  "devDependencies": {
    "basic-auth-connect": "^1.0.0",
    "body-parser": "^1.12.4",
    "eslint": "^0.21.2",
    "express": "^4.12.4",
    "mocha": "^2.2.5",
    "should": "^6.0.3",
    "supertest": "^1.0.1"
  },
  "engines": {
    "node": ">=0.10.0"
  },
  "homepage": "https://github.com/expressjs/cors/",
  "keywords": [
    "connect",
    "cors",
    "express",
    "middleware"
  ],
  "license": "MIT",
  "main": "./lib/index.js",
  "name": "cors",
  "optionalDependencies": {},
  "readme": "# `cors`\n\nCORS is a node.js package for providing a [Connect](http://www.senchalabs.org/connect/)/[Express](http://expressjs.com/) middleware that can be used to enable [CORS](http://en.wikipedia.org/wiki/Cross-origin_resource_sharing) with various options.\n\n**[Follow me (@troygoode) on Twitter!](https://twitter.com/intent/user?screen_name=troygoode)**\n\n[![NPM](https://nodei.co/npm/cors.png?downloads=true&stars=true)](https://nodei.co/npm/cors/)\n\n[![build status](https://secure.travis-ci.org/expressjs/cors.png)](http://travis-ci.org/expressjs/cors)\n* [Installation](#installation)\n* [Usage](#usage)\n  * [Simple Usage](#simple-usage-enable-all-cors-requests)\n  * [Enable CORS for a Single Route](#enable-cors-for-a-single-route)\n  * [Configuring CORS](#configuring-cors)\n  * [Configuring CORS Asynchronously](#configuring-cors-asynchronously)\n  * [Enabling CORS Pre-Flight](#enabling-cors-pre-flight)\n* [Configuration Options](#configuration-options)\n* [Demo](#demo)\n* [License](#license)\n* [Author](#author)\n\n## Installation (via [npm](https://npmjs.org/package/cors))\n\n```bash\n$ npm install cors\n```\n\n## Usage\n\n### Simple Usage (Enable *All* CORS Requests)\n\n```javascript\nvar express = require('express')\n  , cors = require('cors')\n  , app = express();\n\napp.use(cors());\n\napp.get('/products/:id', function(req, res, next){\n  res.json({msg: 'This is CORS-enabled for all origins!'});\n});\n\napp.listen(80, function(){\n  console.log('CORS-enabled web server listening on port 80');\n});\n```\n\n### Enable CORS for a Single Route\n\n```javascript\nvar express = require('express')\n  , cors = require('cors')\n  , app = express();\n\napp.get('/products/:id', cors(), function(req, res, next){\n  res.json({msg: 'This is CORS-enabled for all origins!'});\n});\n\napp.listen(80, function(){\n  console.log('CORS-enabled web server listening on port 80');\n});\n```\n\n### Configuring CORS\n\n```javascript\nvar express = require('express')\n  , cors = require('cors')\n  , app = express();\n\nvar corsOptions = {\n  origin: 'http://example.com'\n};\n\napp.get('/products/:id', cors(corsOptions), function(req, res, next){\n  res.json({msg: 'This is CORS-enabled for only example.com.'});\n});\n\napp.listen(80, function(){\n  console.log('CORS-enabled web server listening on port 80');\n});\n```\n\n### Configuring CORS w/ Dynamic Origin\n\n```javascript\nvar express = require('express')\n  , cors = require('cors')\n  , app = express();\n\nvar whitelist = ['http://example1.com', 'http://example2.com'];\nvar corsOptions = {\n  origin: function(origin, callback){\n    var originIsWhitelisted = whitelist.indexOf(origin) !== -1;\n    callback(null, originIsWhitelisted);\n  }\n};\n\napp.get('/products/:id', cors(corsOptions), function(req, res, next){\n  res.json({msg: 'This is CORS-enabled for a whitelisted domain.'});\n});\n\napp.listen(80, function(){\n  console.log('CORS-enabled web server listening on port 80');\n});\n```\n\n### Enabling CORS Pre-Flight\n\nCertain CORS requests are considered 'complex' and require an initial\n`OPTIONS` request (called the \"pre-flight request\"). An example of a\n'complex' CORS request is one that uses an HTTP verb other than\nGET/HEAD/POST (such as DELETE) or that uses custom headers. To enable\npre-flighting, you must add a new OPTIONS handler for the route you want\nto support:\n\n```javascript\nvar express = require('express')\n  , cors = require('cors')\n  , app = express();\n\napp.options('/products/:id', cors()); // enable pre-flight request for DELETE request\napp.del('/products/:id', cors(), function(req, res, next){\n  res.json({msg: 'This is CORS-enabled for all origins!'});\n});\n\napp.listen(80, function(){\n  console.log('CORS-enabled web server listening on port 80');\n});\n```\n\nYou can also enable pre-flight across-the-board like so:\n\n```\napp.options('*', cors()); // include before other routes\n```\n\n### Configuring CORS Asynchronously\n\n```javascript\nvar express = require('express')\n  , cors = require('cors')\n  , app = express();\n\nvar whitelist = ['http://example1.com', 'http://example2.com'];\nvar corsOptionsDelegate = function(req, callback){\n  var corsOptions;\n  if(whitelist.indexOf(req.header('Origin')) !== -1){\n    corsOptions = { origin: true }; // reflect (enable) the requested origin in the CORS response\n  }else{\n    corsOptions = { origin: false }; // disable CORS for this request\n  }\n  callback(null, corsOptions); // callback expects two parameters: error and options\n};\n\napp.get('/products/:id', cors(corsOptionsDelegate), function(req, res, next){\n  res.json({msg: 'This is CORS-enabled for a whitelisted domain.'});\n});\n\napp.listen(80, function(){\n  console.log('CORS-enabled web server listening on port 80');\n});\n```\n\n## Configuration Options\n\n* `origin`: Configures the **Access-Control-Allow-Origin** CORS header. Expects a string (ex: \"http://example.com\"). Set to `true` to reflect the [request origin](http://tools.ietf.org/html/draft-abarth-origin-09), as defined by `req.header('Origin')`. Set to `false` to disable CORS. Can also be set to a function, which takes the request origin as the first parameter and a callback (which expects the signature `err [object], allow [bool]`) as the second. Finally, it can also be a regular expression (`/example\\.com$/`) or an array of regular expressions and/or strings to match against.\n* `methods`: Configures the **Access-Control-Allow-Methods** CORS header. Expects a comma-delimited string (ex: 'GET,PUT,POST') or an array (ex: `['GET', 'PUT', 'POST']`).\n* `allowedHeaders`: Configures the **Access-Control-Allow-Headers** CORS header. Expects a comma-delimited string (ex: 'Content-Type,Authorization') or an array (ex: `['Content-Type', 'Authorization']`). If not specified, defaults to reflecting the headers specified in the request's **Access-Control-Request-Headers** header.\n* `exposedHeaders`: Configures the **Access-Control-Expose-Headers** CORS header. Expects a comma-delimited string (ex: 'Content-Range,X-Content-Range') or an array (ex: `['Content-Range', 'X-Content-Range']`). If not specified, no custom headers are exposed.\n* `credentials`: Configures the **Access-Control-Allow-Credentials** CORS header. Set to `true` to pass the header, otherwise it is omitted.\n* `maxAge`: Configures the **Access-Control-Allow-Max-Age** CORS header. Set to an integer to pass the header, otherwise it is omitted.\n* `preflightContinue`: Pass the CORS preflight response to the next handler.\n\nFor details on the effect of each CORS header, [read this article on HTML5 Rocks](http://www.html5rocks.com/en/tutorials/cors/).\n\n## Demo\n\nA demo that illustrates CORS working (and not working) using jQuery is available here: [http://node-cors-client.herokuapp.com/](http://node-cors-client.herokuapp.com/)\n\nCode for that demo can be found here:\n\n* Client: [https://github.com/TroyGoode/node-cors-client](https://github.com/TroyGoode/node-cors-client)\n* Server: [https://github.com/TroyGoode/node-cors-server](https://github.com/TroyGoode/node-cors-server)\n\n## License\n\n[MIT License](http://www.opensource.org/licenses/mit-license.php)\n\n## Author\n\n[Troy Goode](https://github.com/TroyGoode) ([troygoode@gmail.com](mailto:troygoode@gmail.com))\n",
  "readmeFilename": "README.md",
  "repository": {
    "type": "git",
    "url": "git://github.com/expressjs/cors.git"
  },
  "scripts": {
    "lint": "./node_modules/eslint/bin/eslint.js lib test",
    "test": "npm run lint && ./node_modules/mocha/bin/mocha"
  },
  "version": "2.7.1"
}