Node Express服务器CORS正则配置错误求助

Ah, I see the issue here! When you tried using https?://the.real.url.com:8081 directly as the origin value, you ran into an error because browsers don't accept regular expression strings as valid values for the Access-Control-Allow-Origin header. That header expects either a specific origin, *, or a dynamically generated valid origin based on the request.

To handle dynamic origin matching with regex in Express, you need to use a custom function with the cors middleware. Here's how to fix it step by step:

Step 1: Ensure the cors package is installed #

If you haven't already, install the official CORS middleware for Express:

npm install cors

Step 2: Configure CORS with a custom origin validator #

Replace your static origin value with a function that uses regex to validate incoming request origins. This function will dynamically return a valid origin for the response header:

const express = require('express');
const cors = require('cors');
const app = express();

// Define a regex pattern to match valid origins
// Supports http/https, your exact domain, and optional port numbers
const allowedOriginRegex = /^https?:\/\/the\.real\.url\.com(:\d+)?$/;

app.use(cors({
  origin: function (requestOrigin, callback) {
    // Allow requests with no origin (e.g., curl commands or same-origin requests)
    if (!requestOrigin) return callback(null, true);

    // Check if the incoming origin matches our regex pattern
    if (allowedOriginRegex.test(requestOrigin)) {
      // Return the valid origin (or `true` to use the request's origin directly)
      return callback(null, requestOrigin);
    } else {
      // Reject origins that don't match
      return callback(new Error('Not allowed by CORS'), false);
    }
  }
}));

// Rest of your server logic goes here...
app.listen(3000, () => {
  console.log('Server running on port 3000');
});

Let's break down the regex pattern #

The ^https?:\/\/the\.real\.url\.com(:\d+)?$ regex does exactly what you need:

• ^https?:\/\/: Matches either http:// or https:// (the ? makes the 's' optional)
• the\.real\.url\.com: Matches your exact domain name (dots are escaped with \. because unescaped dots in regex match any character)
• (:\d+)?: Allows an optional port number (the ? means this section can be present or absent; :\d+ matches a colon followed by one or more digits)
• $: Ensures the string ends immediately after the domain/port, preventing partial matches

Bonus: Extra considerations #

• If you need to support multiple valid domains, expand the regex (e.g., ^https?:\/\/(the\.real\.url\.com|another\.valid\.domain)(:\d+)?$)
• Returning requestOrigin instead of true makes the response header more specific, which is safer if you need to allow credentials (like cookies or HTTP authentication)

内容的提问来源于stack exchange，提问作者william