Node.js双服务器配置CORS过滤器仍遇跨域错误求助

Hey there, it’s frustrating when CORS errors stick around even after you’ve set up filters—let’s break down the most likely issues and fixes to get this sorted:

1. Make sure your Express CORS middleware is complete (and handles preflight requests) #

Your code snippet cuts off, so my first guess is that you might not be handling preflight OPTIONS requests—these are automatic browser checks for non-simple requests (like POST with JSON, or requests with custom headers). Rolling your own middleware works, but it’s easy to miss this critical step.

Instead of writing custom code, use the official cors npm package—it handles preflight and edge cases automatically. First install it:

npm install cors

Then configure it in your Express app:

const cors = require('cors');
const app = express();

// Allow all origins (swap with your static server's URL for production)
app.use(cors({
  origin: '*', 
  allowedHeaders: ['Origin', 'X-Requested-With', 'Content-Type', 'Accept'],
  methods: ['GET', 'POST', 'PUT', 'DELETE', 'OPTIONS']
}));

// If you want to stick with custom middleware, add OPTIONS handling:
// app.use((req, res, next) => {
//   res.header("Access-Control-Allow-Origin", "*");
//   res.header("Access-Control-Allow-Headers", "Origin, X-Requested-With, Content-Type, Accept");
//   res.header("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE, OPTIONS");
//   // Respond to preflight requests immediately
//   if (req.method === 'OPTIONS') {
//     return res.sendStatus(200);
//   }
//   next();
// });

2. Verify the origin matches exactly what your browser is sending #

If you’re testing locally (e.g., http-server on http://localhost:8080), hardcoding that origin instead of using * can fix unexpected issues—especially if your frontend sends credentials (cookies, auth tokens). For example:

app.use(cors({
  origin: 'http://localhost:8080', // Match your static server's URL exactly (port included!)
  credentials: true // Add this if you're sending cookies or auth headers
}));

Double-check the origin in your browser’s dev tools (Network tab → Request Headers → Origin) to make sure it matches what you’ve allowed.

3. Check if http-server is adding conflicting headers #

While CORS is mostly handled by your Express API, sometimes http-server can send restrictive headers that interfere. Run http-server with CORS enabled just to rule this out:

http-server --cors

This ensures the static server doesn’t block the browser from making cross-origin requests to your API.

4. Inspect headers in browser dev tools to confirm they’re being sent #

Open your browser’s Network tab, find the failing request, and look at the Response Headers. If the Access-Control-Allow-Origin header is missing, your middleware isn’t being applied correctly—maybe it’s placed after your route handlers, or there’s an error in your code that’s stopping it from running.

Also, check the Request Headers to see what Origin the browser is sending. It should match the origin you’ve allowed in your Express config.

5. Rule out proxy interference #

If you’re using a reverse proxy (like Nginx) between your servers and the client, it might be stripping or modifying CORS headers. Make sure your proxy config isn’t adding conflicting Access-Control-Allow-Origin headers that override what Express sends.

Most of the time, the issue boils down to missing preflight handling, a mismatched origin, or middleware not being applied correctly. Give these steps a shot, and let me know if you still run into issues!

内容的提问来源于stack exchange，提问作者Bilbo Baggins