AbsoluteJS

CORS

Use @elysiajs/cors for predictable cross-origin behavior in AbsoluteJS APIs.

#Install

BASH
bun add @elysiajs/cors

#Basic Usage

TS
import { Elysia } from 'elysia';
import { cors } from '@elysiajs/cors';

new Elysia()
  .use(cors())
  .get('/api/ping', () => 'pong');

#Restricted Origins

Restrict CORS to known frontends and explicitly list methods and headers:

TS
import { Elysia } from 'elysia';
import { cors } from '@elysiajs/cors';

new Elysia()
  .use(
    cors({
      origin: ['https://app.example.com', 'https://admin.example.com'],
      methods: ['GET', 'POST', 'PUT', 'DELETE'],
      allowedHeaders: ['Content-Type', 'Authorization'],
      credentials: true
    })
  );

#Dynamic Origin Logic

Use a function for environment-aware origin rules:

TS
import { Elysia } from 'elysia';
import { cors } from '@elysiajs/cors';

const allowlist = new Set([
  'https://app.example.com',
  'https://staging.example.com'
]);

new Elysia()
  .use(
    cors({
      origin: (origin) => !origin || allowlist.has(origin),
      credentials: true
    })
  );

#Per-Group CORS

Apply different CORS policies to separate route groups:

TS
import { Elysia } from 'elysia';
import { cors } from '@elysiajs/cors';

new Elysia()
  .group('/api/public', (app) =>
    app
      .use(cors())
      .get('/status', () => ({ ok: true }))
  )
  .group('/api/internal', (app) =>
    app
      .use(cors({ origin: ['https://ops.example.com'] }))
      .get('/metrics', () => getMetrics())
  );

#References

Elysia CORS plugin docs