Flask-CORS

You can use Flask-CORS as a Flask extension to provide centralized Cross-Origin Resource Sharing (CORS) configuration for your application. This allows you to define CORS rules for your resources using patterns rather than applying them to individual routes manually.

# Note: The actual implementation is contained in examples/app_based_example.py
# It demonstrates using Flask-CORS as an extension to manage resources by patterns.

By default, flask-cors disables the submission of cookies across domains for security reasons. To allow cross-site cookies or authenticated requests (credentials), set the supports_credentials option to True when initializing the extension.

Warning: If you enable this, ensure you have implemented CSRF (Cross-Site Request Forgery) protection to secure your application.

from flask import Flask, session
from flask_cors import CORS

app = Flask(__name__)
CORS(app, supports_credentials=True)

@app.route("/")
def helloWorld():
  return "Hello, %s" % session['username']

Install the flask-cors extension using pip or your preferred package manager.

pip install -U flask-cors

To enable CORS support for all routes, all origins, and all methods in your Flask application, initialize the CORS extension by passing your app instance to it. This is the simplest way to allow cross-origin AJAX requests globally.

from flask import Flask
from flask_cors import CORS

app = Flask(__name__)
CORS(app)

@app.route("/")
def helloWorld():
  return "Hello, cross-origin-world!"

Install the extension using pip or easy_install to enable CORS support in your Flask application.

$ pip install -U flask-cors

The simplest way to use Flask-CORS is to initialize the CORS extension with your Flask app instance. By default, this enables CORS support for all routes, all origins, and all methods.

from flask import Flask
from flask_cors import CORS

app = Flask(__name__)
CORS(app)

@app.route("/")
def helloWorld():
  return "Hello, cross-origin-world!"

Flask-CORS supports Flask Blueprints natively. To apply CORS settings to a specific blueprint rather than the entire application, pass the blueprint instance to the CORS extension constructor. This allows you to isolate CORS configurations to specific modules or routes defined within that blueprint.

from flask import Blueprint
from flask_cors import CORS

my_blueprint = Blueprint('my_blueprint', __name__)
# Pass the blueprint instance to CORS to apply settings to it
CORS(my_blueprint)

The resources argument allows you to map specific URL patterns to specific CORS configurations.

Accepted shapes for ResourceSpec:

• A single pattern (string or regex) applied to all routes.
• A list of patterns, all using the default configuration.
• A dictionary mapping ResourcePattern to a dictionary of specific options (e.g., dict[ResourcePattern, dict[str, Any]]).

Patterns can be literal strings or pre-compiled regular expressions (re.Pattern).

# Mapping specific paths to specific CORS settings
CORS(app, resources=[
    r"/public/*": {"origins": "*"},
    r"/api/v1/*": {"origins": "https://api.example.com", "supports_credentials": True}
])

If CORS is not behaving as expected, you can enable debug logging for the flask_cors logger to inspect the underlying logic and headers.

import logging
logging.getLogger('flask_cors').level = logging.DEBUG

Instead of applying CORS to an entire Flask application, you can use CORS as a decorator on specific view functions. This allows you to isolate CORS configuration to a small subset of views, providing more granular control over which endpoints are accessible cross-origin.

# Note: The actual implementation is in examples/view_based_example.py
# It demonstrates applying the @CORS() decorator to specific routes.

If you prefer a decorator-based approach, you can use @cross_origin() on specific Flask routes. This must be placed below the @app.route(...) decorator. This allows you to enable CORS on a per-route basis rather than globally.

@app.route("/")
@cross_origin()
def helloWorld():
  return "Hello, cross-origin-world!"

You can apply specific CORS settings to certain paths by passing a resources dictionary to the CORS constructor. This dictionary maps URL patterns (as regex strings) to a set of configuration options, such as origins.

app = Flask(__name__)
# This allows all origins ('*') only for paths matching '/api/*'
cors = CORS(app, resources={r"/api/*": {"origins": "*"}})

@app.route("/api/v1/users")
def list_users():
  return "user example"