{"id":17148,"library":"access-control","title":"HTTP Access Control (CORS) Handler","description":"The `access-control` package offers a minimal and straightforward implementation for managing HTTP Access Control (CORS) according to the W3C specification. It is designed as a focused utility for applications needing to handle cross-origin requests, abstracting the complexities of CORS header management. As of its last known release, the package is at version 1.0.1, published over 8 years ago, indicating it is no longer actively maintained. Its core functionality involves configuring allowed origins, HTTP methods, credentials handling, preflight request caching (`maxAge`), and exposing/allowing specific headers. A key differentiator is its direct handling of `OPTIONS` preflight requests and automatic `403 Forbidden` responses for invalid CORS attempts, as well as automatic adjustment of `Access-Control-Allow-Origin` when `*` is combined with `credentials: true` for specification compliance.","status":"abandoned","version":"1.0.1","language":"javascript","source_language":"en","source_url":"https://github.com/primus/access-control","tags":["javascript","CORS","HTTP","Access","Control","Allow","Origin"],"install":[{"cmd":"npm install access-control","lang":"bash","label":"npm"},{"cmd":"yarn add access-control","lang":"bash","label":"yarn"},{"cmd":"pnpm add access-control","lang":"bash","label":"pnpm"}],"dependencies":[{"reason":"Used for parsing the `maxAge` option, which supports human-readable strings like '1 hour' for preflight cache duration.","package":"ms","optional":false}],"imports":[{"note":"The primary export is a default function that configures the middleware. This package predates widespread ESM usage and is primarily CommonJS (`require`).","wrong":"import { access } from 'access-control';","symbol":"default","correct":"import access from 'access-control';"},{"note":"This is the standard CommonJS import pattern for the main function provided by the library.","wrong":"const { access } = require('access-control');","symbol":"access","correct":"const access = require('access-control');"},{"note":"The `access` function returns another function (the actual CORS middleware) that should be used in your request handling logic.","wrong":"access({ origins: ['http://example.com'] }); // Does not return the middleware","symbol":"ConfiguredCORSHandler","correct":"const corsMiddleware = access({ origins: ['http://example.com'] });"}],"quickstart":{"code":"'use strict';\n\nconst access = require('access-control');\nconst http = require('http');\n\n// Configure the CORS middleware\nconst corsHandler = access({\n  maxAge: '1 hour',\n  credentials: true,\n  origins: 'http://example.com'\n});\n\nconst server = http.createServer((req, res) => {\n  // The corsHandler function processes the request and response.\n  // If it returns `true`, it means it handled the request (e.g., preflight or error),\n  // and no further response is needed from your application logic.\n  if (corsHandler(req, res)) {\n    return;\n  }\n\n  // For valid, non-preflight requests that pass CORS checks, proceed with application logic.\n  res.writeHead(200, { 'Content-Type': 'text/plain' });\n  res.end('Hello from a valid CORS request!');\n});\n\nserver.listen(8080, () => {\n  console.log('CORS-enabled server listening on http://localhost:8080');\n});","lang":"javascript","description":"Illustrates how to configure `access-control` with specific origins and credentials, and integrate the resulting middleware into a Node.js HTTP server to handle CORS preflight requests and secure responses."},"warnings":[{"fix":"Migrate to an actively maintained CORS middleware solution like `cors` from npm or implement CORS headers manually.","message":"This package is considered abandoned, with no updates in over 8 years. It may not be compatible with modern Node.js versions, current browser CORS specifications, or recent security best practices. Relying on an unmaintained package for security-sensitive features like CORS is strongly discouraged.","severity":"breaking","affected_versions":"all"},{"fix":"Be aware of this automatic adjustment. If you require `*` origin and credentials, your setup is non-compliant and this library correctly modifies behavior. Consider specific origins instead of `*` when credentials are needed.","message":"When `credentials` is set to `true` and `origins` is set to `*`, the `Access-Control-Allow-Origin` header will automatically be changed from `*` to the actual `Origin` header from the request. This is done to comply with the W3C CORS specification, which disallows `*` with credentials.","severity":"gotcha","affected_versions":">=1.0.0"},{"fix":"If using ESM, ensure your bundler or Node.js environment is configured to handle CommonJS imports. Consider using a TypeScript-first or ESM-native CORS solution for modern projects.","message":"The package is written in CommonJS and does not officially support ES Modules. While it may be usable via an `import access from 'access-control';` statement in some environments, native ESM usage or specific tooling configurations might be required, and type definitions are not provided.","severity":"gotcha","affected_versions":"all"}],"env_vars":null,"search_vec":"'1.0.1':62 '403':107 '8':65 'abstract':44 'access':2,8,20,121,137 'access-control':7 'access-control-allow-origin':120 'accord':23 'activ':73 'adjust':118 'ago':67 'allow':80,123,139 'applic':36 'attempt':113 'automat':106,117 'cach':88 'combin':127 'complex':46 'complianc':133 'configur':79 'control':3,9,21,122,138 'cor':4,22,48,112,135 'core':76 'credenti':84,129 'cross':41 'cross-origin':40 'design':30 'differenti':96 'direct':99 'exposing/allowing':91 'focus':33 'forbidden':108 'function':77 'handl':39,85,100 'handler':5 'header':49,93 'http':1,19,82,136 'implement':16 'indic':68 'invalid':111 'involv':78 'javascript':134 'key':95 'known':55 'last':54 'longer':72 'maintain':74 'manag':18,50 'maxag':89 'method':83 'minim':13 'need':37 'offer':11 'option':102 'origin':42,81,124,140 'packag':10,58 'preflight':86,103 'publish':63 'releas':56 'request':43,87,104 'respons':109 'specif':27,92,132 'straightforward':15 'true':130 'util':34 'version':61 'w3c':26 'well':115 'year':66","created_at":"2026-04-22T16:29:53.801613+00:00","updated_at":"2026-04-22T16:29:53.801613+00:00","problems":[{"fix":"First call `access(options)` to get the middleware, then use the returned function: `const cors = access({ ... }); http.createServer(function (req, res) { if (cors(req, res)) return; ... });`","cause":"Attempting to call the `access-control` module directly as a middleware, instead of first configuring it with options to get the actual middleware function.","error":"TypeError: access is not a function"},{"fix":"Ensure the client's `Origin` header exactly matches one of the allowed origins (e.g., `'http://example.com'`) or configure `origins` to `*` if appropriate (though with caution for security). Also, verify `methods` and `headers` options cover all operations the client intends to perform.","cause":"The origin of the client request is not allowed by the `origins` option, or other headers/methods are not permitted, leading to the library rejecting the request or not adding the necessary CORS headers.","error":"Access to fetch at '...' from origin '...' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource."}],"ecosystem":"npm","meta_description":null,"install_score":null,"quickstart_score":null,"quickstart_tag":null,"pypi_latest":"0.3.0","cli_name":"","cli_version":null,"type":"library","homepage":null,"github":"https://github.com/primus/access-control","docs":null,"changelog":null,"pypi":null,"npm":"https://www.npmjs.com/package/access-control","openapi_spec":null,"status_page":null,"smithery":null,"categories":["http-networking","web-framework","auth-security"],"base_url":null,"auth_type":null,"provenance":{"verified_status":null,"verified_at":null,"last_verified":"2026-06-17","next_check":"2026-07-21","install_tag":null}}