Enable CORS

You have a browser front end on https://app.example.com calling a Flare API on a different origin, and the browser is blocking the responses. Declare one CORS policy with host.http.cors(config). You don’t write an OPTIONS handler and you don’t set Access-Control-* headers yourself.

Steps

1. Build a CorsConfig: at minimum, the origins you allow.
2. Register it once on the arc with host.http.cors(config).
3. Leave preflight to Flare.

import { FlareHost, FlareResponse } from "@flare-ts/core";
import { node } from "@flare-ts/core/node";

const host = new FlareHost(node);

host.http.cors({
  origins: ["https://app.example.com"],
  credentials: true,
});

host.http.get("/users", () => new FlareResponse(200, { users: [] }));

const app = host.build();
app.run();

Every route on the arc is covered. Cross-origin requests from allowed origins get Access-Control-Allow-Origin, and preflight gets 204 with the right headers before your handler runs.

CorsConfig fields

Only origins is required.

Field	Required?	What it does
origins	Yes	'*', a single origin, an allowlist array, or (origin) => boolean | Promise<boolean>
methods	No	Allowed methods; omitted → derived from handlers on each path at build()
headers	No	Allowed request headers on preflight
expose	No	Response headers exposed to client JS
credentials	No	Whether credentials are allowed. Incompatible with origins: '*'
maxAge	No	Preflight cache seconds (default 7200)

Different policy for one group

import { FlareHost, FlareResponse } from "@flare-ts/core";
import { node } from "@flare-ts/core/node";

const host = new FlareHost(node);

host.http.cors({
  origins: ["https://app.example.com"],
  credentials: true,
});

host.http.get("/users", () => new FlareResponse(200, { users: [] }));

host.http.group("/public", (g) => {
  g.cors({ origins: "*", credentials: false });
  g.get("/status", () => new FlareResponse(200, { ok: true }));
  return g.register();
});

const app = host.build();
app.run();

Routes under /public use the wildcard policy. Everything else keeps the arc policy.

Notes

• A denied origin gets 204 with no Access-Control-Allow-Origin, not 403. The browser enforces the block.
• Leave methods off unless you need to override. Flare derives the set from registered handlers per path.

Related

• CORS overview
• Route groups and versioning