CORSMiddleware

Configure Cross-Origin Resource Sharing (CORS) for your FastAPI application

CORSMiddleware

The CORSMiddleware allows you to configure Cross-Origin Resource Sharing (CORS) for your FastAPI application, enabling browsers to make cross-origin requests from frontend applications.

Usage

from fastapi import FastAPI
from fastapi.middleware.cors import CORSMiddleware

app = FastAPI()

app.add_middleware(
    CORSMiddleware,
    allow_origins=["https://example.com"],
    allow_credentials=True,
    allow_methods=["*"],
    allow_headers=["*"],
)

Parameters

allow_origins · list[str] · required

A list of origins that are allowed to make cross-origin requests. Use ["*"] to allow any origin. For example: ["https://example.com", "https://app.example.com"].

allow_origin_regex · str | None · default: "None"

A regex pattern string to match against origins. For example: https://.*\.example\.com.

allow_methods · list[str] · default: "['GET']"

A list of HTTP methods that are allowed for cross-origin requests. Use ["*"] to allow all standard methods. Default is ["GET"].

allow_headers · list[str] · default: "[]"

A list of HTTP request headers that are allowed for cross-origin requests. Use ["*"] to allow all headers. The Accept, Accept-Language, Content-Language, and Content-Type headers are always allowed for CORS requests.

allow_credentials · bool · default: "False"

Indicates whether cookies should be supported for cross-origin requests. If set to True, the allow_origins cannot be ["*"], and must specify origins explicitly.

expose_headers · list[str] · default: "[]"

A list of HTTP response headers that should be made accessible to the browser. By default, only simple response headers are exposed.

max_age · int · default: "600"

The maximum time in seconds that browsers can cache CORS responses. Default is 600 seconds (10 minutes).

Example with Multiple Origins

from fastapi import FastAPI
from fastapi.middleware.cors import CORSMiddleware

app = FastAPI()

origins = [
    "http://localhost:3000",
    "http://localhost:8080",
    "https://example.com",
    "https://www.example.com",
]

app.add_middleware(
    CORSMiddleware,
    allow_origins=origins,
    allow_credentials=True,
    allow_methods=["*"],
    allow_headers=["*"],
    expose_headers=["X-Custom-Header"],
    max_age=3600,
)

Security Considerations

• Avoid using allow_origins=["*"] in production unless your API is truly public
• When using allow_credentials=True, you must specify explicit origins
• Use allow_origin_regex carefully to avoid overly permissive patterns
• Consider limiting allow_methods and allow_headers to only what your application needs