CORS Configuration with Claude Code: Origin Control and Preflight Optimization

Misconfigured CORS is a security hole — Access-Control-Allow-Origin: * in production lets any site call your API. Claude Code generates safe CORS configuration from CLAUDE.md rules. CLAUDE.md for CORS Rules ## CORS Configuration Rules ### Security (required) - Never use `Access-Control-Allow-Origin: *` in production - Load allowed origins from env variables (no hardcoding) - When using credentials, only allow specific origins (incompatible with * ) - Only allow methods explicitly needed (DELETE etc. must be explicit) ### Preflight - Register CORS middleware before all routes - Return 204 for OPTIONS requests (no body) - Preflight cache: max-age=86400 (24 hours) ### Headers - Request: Content-Type, Authorization, X-Request-ID - Response: X-Total-Count, X-Request-ID (expose custom headers) Generating CORS Configuration Generate CORS configuration . Requirements : - Switch allowed origins between production / development - Support credentials ( cookie auth ) - 24 - hour preflight cache -