CORS neman nene ne kuma ana gane a yi a cikin Node?

Question

Accepted Answer

**CORS** (Cross-Origin Resource Sharing) shine tsarin kariya na birayi wanda ke damina ko waje tun webosaiti daga **origin** guda iya yin bukatun gida zuwa sarevaa kan **origin daban**. A asali, birayi suna damina bukatun cross-origin; sarevaa dole ne ta baiwa izini a zahiri ta hanyar response headers.

## Siyasar same-origin da matsala

```text
Origin = scheme + host + port. These are DIFFERENT origins:
  https://app.example.com   →  https://api.example.com   (different host)
  http://localhost:3000     →  http://localhost:4000      (different port)

Browser blocks the cross-origin request UNLESS the server sends CORS headers allowing it.
```

Don haka React app akan `localhost:3000` da ke kira API akan `localhost:4000` shine cross-origin — birayi ka damina shi sai dai API ta bai da izini.

## Manyan anfani na amsa

```text
Access-Control-Allow-Origin: https://app.example.com   ← who is allowed
Access-Control-Allow-Methods: GET, POST, PUT, DELETE   ← allowed methods
Access-Control-Allow-Headers: Content-Type, Authorization
Access-Control-Allow-Credentials: true                 ← allow cookies/auth
```

Sarevaa tana damina bukatun ta hanyar aika wajen wannan. Birayi ita ce zai karanta su kuma ta yanke hukunci ko waje yana karya iya ganin amsa.

## Jiyya CORS a cikin Express

```js
import cors from "cors";

// ❌ allow everything — convenient but insecure for credentialed/private APIs
app.use(cors());

// ✅ restrict to specific trusted origins
app.use(cors({
  origin: ["https://app.example.com", "http://localhost:3000"], // allowlist
  methods: ["GET", "POST", "PUT", "DELETE"],
  credentials: true, // allow cookies — REQUIRES a specific origin (not "*")
}));
```

Middleware na `cors` ta saita headers maka. Domin sigina, **damina `origin` zuwa jerin amarya** maimakon `*` — kuma lura cewa ba'a yarda da asusun alamomi (`credentials: true`) ba tare da `*` wildcard ba.

## Bukatun preflight

```text
For "non-simple" requests (PUT/DELETE, custom headers, JSON), the browser first
sends an OPTIONS "preflight" request to check permissions. The cors middleware
handles responding to it automatically.
```

## Fahimta da rugujewar gargajiya

```text
CORS is enforced by the BROWSER, not the server. It does NOT protect your API
from non-browser clients (curl, Postman, other servers) — those ignore CORS.
It only governs what browser JavaScript on other origins can do.
```

## Me ya sa ita ta zama muhimmi

CORS shine ido daya daga cikin kasua da aka fi gani a habakar gida — kusan kowa da suke aiki da API na gida sannu da wannan (musamman a baikowa tare da ports daban-daban).

Tubatar da menene ya sa an aike (kariya same-origin na birayi), ta menene sarevaa ta karba ta hanyar headers, ta menene a dace da kariya (jerin amarya na origins, jiyya tausayi na asusun alamomi), kuma gaskiya ce a zahiri cewa shine _sarevaa_ tsarin (ba kariya API ba) wajib ne don cekacinkai kuma jiya gida front-ends zuwa Node APIs ba tare da baddewa ba ko fitar da sarevaa.