Cad is CORS ann agus conas a bhainistíonn tú é i Node?

Question

Accepted Answer

**CORS** (Cross-Origin Resource Sharing) is a browser security mechanism that controls whether a web page from one **origin** can make requests to a server on a **different origin**. By default, browsers block cross-origin requests; the server must explicitly allow them via response headers.

## An same-origin policy agus an fhadhb

```text
Origin = scheme + host + port. These are DIFFERENT origins:
  https://app.example.com   →  https://api.example.com   (different host)
  http://localhost:3000     →  http://localhost:4000      (different port)

Browser blocks the cross-origin request UNLESS the server sends CORS headers allowing it.
```

Mar sin is cross-origin a bhíonn ar app React ar `localhost:3000` ag glaoch ar API ar `localhost:4000` — blocálann an brabhsálaí é mura bhfuil an API rite ann.

## Na príomh-cheanglóirí freagartha

```text
Access-Control-Allow-Origin: https://app.example.com   ← who is allowed
Access-Control-Allow-Methods: GET, POST, PUT, DELETE   ← allowed methods
Access-Control-Allow-Headers: Content-Type, Authorization
Access-Control-Allow-Credentials: true                 ← allow cookies/auth
```

Baineann an freastalaí úsáid as na ceanglóirí seo chun rochtain a dhéanamh. Léann an brabhsálaí iad agus socraíonn sé an bhfuil cead ag an leathanach an freagra a fheiceáil.

## Bainistiú CORS i Express

```js
import cors from "cors";

// ❌ allow everything — convenient but insecure for credentialed/private APIs
app.use(cors());

// ✅ restrict to specific trusted origins
app.use(cors({
  origin: ["https://app.example.com", "http://localhost:3000"], // allowlist
  methods: ["GET", "POST", "PUT", "DELETE"],
  credentials: true, // allow cookies — REQUIRES a specific origin (not "*")
}));
```

Socrú an `cors` middleware na ceanglóirí duit. Do tháirgeadh, **restrict `origin` to an allowlist** seachas `*` — agus tabhair faoi deara go bhfuil creidiúnais ceadaithe (`credentials: true`) incompatible leis an wildcard `*`.

## Iarratais réamhfhilte

```text
For "non-simple" requests (PUT/DELETE, custom headers, JSON), the browser first
sends an OPTIONS "preflight" request to check permissions. The cors middleware
handles responding to it automatically.
```

## Míshuim choiteann

```text
CORS is enforced by the BROWSER, not the server. It does NOT protect your API
from non-browser clients (curl, Postman, other servers) — those ignore CORS.
It only governs what browser JavaScript on other origins can do.
```

## Cén fáth a bhfuil sé tábhachtach

Is CORS ceann de na droichbhac is coiteann i bhforbairt gréine — beagnach gach socrú front-end-go-API a thagann ina choinne (go háirithe i bhforbairt áitiúil le ports éagsúla).

Bheith ag tuiscint *cén fáth* a bhfuil sé ann (slándáil same-origin an bhrabhsálaí), conas a dhéanann an freastalaí rite via ceanglóirí, conas a chumrú go sábháilte (origins allowlist, láimhseáil chúramach creidiúnais), agus an fhíric ríthábhachtach go bhfuil sé ina mheicníochas *brabhsálaí* (ní údarú API) is riachtanach chun front-ends a cheangal i Node APIs i gceart agus go slán gan a bheith blocáilte nó ag foluain an freastalaí.