CORS Handler Plugin

Configure CORS policy for your oRPC API with CORSHandlerPlugin, including allowed origins, methods, and exposed headers.

Basic

import { class CORSHandlerPlugin<T extends Context>
Configures the [CORS Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS)
for your API, including preflight requests.
@see{@link https://orpc.dev/docs/plugins/cors CORS Handler Plugin}CORSHandlerPlugin } from '@orpc/server/plugins'

const 
const handler: RPCHandler<{
    headers?: IncomingHttpHeaders;
} & object>handler = new 
new RPCHandler<{
    headers?: IncomingHttpHeaders;
} & object>(router: Router<{
    headers?: IncomingHttpHeaders;
} & object>, options?: NoInfer<RPCHandlerOptions<{
    headers?: IncomingHttpHeaders;
} & object>>): RPCHandler<{
    headers?: IncomingHttpHeaders;
} & object>
Serves an oRPC router over the RPC protocol using the Fetch API
(Request/Response), supported by modern runtimes like Deno, Bun,
Cloudflare Workers, and browsers.
@see{@link https://orpc.dev/docs/adapters/fetch-api Fetch API Adapter}RPCHandler(
const router: {
    planet: {
        list: ImplementedProcedure<{
            headers?: IncomingHttpHeaders;
        } & object, object, ZodObject<{
            limit: ZodOptional<ZodNumber>;
            cursor: ZodDefault<ZodNumber>;
        }, $strip>, ZodArray<ZodObject<{
            id: ZodNumber;
            name: ZodString;
            description: ZodOptional<ZodString>;
        }, $strip>>, object>;
        find: ImplementedProcedure<{
            headers?: IncomingHttpHeaders;
        } & object, object, ZodObject<{
            id: ZodNumber;
        }, $strip>, ZodObject<...>, object>;
        create: ImplementedProcedure<...>;
    };
}router, {
  
FetchHandlerOptions<{ headers?: IncomingHttpHeaders; } & object>.plugins?: FetchHandlerPlugin<{
    headers?: IncomingHttpHeaders;
} & object>[] | undefinedplugins: [
    new 
new CORSHandlerPlugin<{
    headers?: IncomingHttpHeaders;
} & object>(options?: CORSHandlerPluginOptions<{
    headers?: IncomingHttpHeaders;
} & object>): CORSHandlerPlugin<{
    headers?: IncomingHttpHeaders;
} & object>
Configures the [CORS Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS)
for your API, including preflight requests.
@see{@link https://orpc.dev/docs/plugins/cors CORS Handler Plugin}CORSHandlerPlugin({
      
CORSHandlerPluginOptions<{ headers?: IncomingHttpHeaders; } & object>.origin?: Value<Promisable<string | readonly string[] | null | undefined>, [origin: string | undefined, options: StandardHandlerRoutingInterceptorOptions<{
    headers?: IncomingHttpHeaders;
} & object>]>
Configures the `Access-Control-Allow-Origin` header.
Can be a string, an array of allowed origins, or a function (optionally async) that returns the allowed origin(s).
@default'*'origin: ['https://app.example.com', 'https://admin.example.com'],
      CORSHandlerPluginOptions<T extends Context>.allowMethods?: readonly string[] | undefined
Configures the `Access-Control-Allow-Methods` header for preflight requests.
@default['GET', 'HEAD', 'PUT', 'POST', 'DELETE', 'PATCH', 'QUERY']allowMethods: ['GET', 'HEAD', 'PUT', 'POST', 'DELETE', 'PATCH', 'QUERY'],
      // ...
    }),
  ],
})

Dynamic Origin

The origin and timingOrigin options also accept a function (optionally async) that receives the request origin and the interceptor options, including the handler context. This lets you resolve the allowed origin per request:

const handler = new RPCHandler(router, {
  plugins: [
    new CORSHandlerPlugin({
      origin: async (origin, { context }) => context.tenant ? origin : null,
    }),
  ],
})

Learn More

For implementation details, see the source code.