{"record":{"id":"9c6af00451754201","repo":"balderdashy/sails","slug":"invalid-cors-settings-for-route-route","errorCode":null,"errorMessage":"Invalid CORS settings for route ${route}","messagePattern":"Invalid CORS settings for route (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"lib/hooks/security/cors/index.js","lineNumber":95,"sourceCode":"        // Else if cors is set to a string, use that has the origin\n        else if (typeof routeCorsConfig === 'string') {\n          optionsRouteConfigs[path][verb || 'default'] = _.extend({allowOrigins: [routeCorsConfig]});\n          sails.router.bind(route, setHeaders(_.extend({}, sails.config.security.cors, {allowOrigins: [routeCorsConfig], methods: verb})), null, {_middlewareType: 'CORS HOOK: setHeaders'});\n        }\n\n        // Else if cors is an object, use that as the config\n        else if (_.isPlainObject(routeCorsConfig)) {\n\n          // Set configuration for the preflight OPTIONS request for this route.\n          optionsRouteConfigs[path][verb || 'default'] = routeCorsConfig;\n\n          // Bind a route that will set CORS headers for this url/path combo.\n          sails.router.bind(route, setHeaders(_.extend({}, routeCorsConfig)), null, {_middlewareType: 'CORS HOOK: setHeaders'});\n        }\n\n        // Otherwise we don't recognize the CORS config, so throw a warning\n        else {\n          sails.log.warn('Invalid CORS settings for route '+route);\n        }\n\n      });\n\n      // Now that we have `optionsRouteConfigs`, a list of all of the routes that (possibly) need\n      // to be preflighted, construct a route that will handle OPTIONS requests for all of those routes.\n      // Sending the result of `setPreflightConfig` (a function) into `setHeaders` will cause `setHeaders`\n      // to run the function in order to determine the CORS options to use.\n      sails.router.bind('options /*', setHeaders(setPreflightConfig(optionsRouteConfigs, sails.config.security.cors)), 'options', {_middlewareType: 'CORS HOOK: preflight'});\n\n    });\n\n\n    // Continue loading this Sails app.\n    return;\n\n  };\n","sourceCodeStart":77,"sourceCodeEnd":113,"githubUrl":"https://github.com/balderdashy/sails/blob/7b76422cc27823df033572bdda5c4910a68b697f/lib/hooks/security/cors/index.js#L77-L113","documentation":"The CORS hook iterates the configured routes in `sails.config.cors.routes`; each entry's value must be a recognized CORS config (e.g. a string origin like 'http://example.com', '*', an object of CORS options, or 'skipper'). If the value is something unrecognized, the hook logs this warning and skips binding the CORS headers route for that path, leaving the route without CORS headers.","triggerScenarios":"Setting a route entry in `sails.config.cors.routes` to an invalid value such as `'/foo': true`, `'/foo': 123`, or a typo'd string, then lifting the app.","commonSituations":"Typos in the origin string, boolean/numeric values instead of origin strings, copy-pasted config from older Sails 0.12 docs into Sails 1.x.","solutions":["Change the route's value to a valid origin string, '*', 'skipper', or a CORS options object","Validate config/cors.js against the Sails 1.x CORS documentation schema","Check the lift logs for other CORS warnings to catch all bad entries at once"],"exampleFix":"// before\nroutes: { '/api/*': true }\n// after\nroutes: { '/api/*': 'http://example.com' }","handlingStrategy":"validation","validationCode":"const VALID = (v) => typeof v === 'string' || (v && typeof v === 'object' && !Array.isArray(v));\nfor (const [route, cfg] of Object.entries(sails.config.cors.routes || {})) {\n  if (!VALID(cfg)) console.warn(`Invalid CORS settings for route ${route}`);\n}","typeGuard":"function isValidCorsConfig(v) {\n  return typeof v === 'string' || (v !== null && typeof v === 'object');\n}","tryCatchPattern":null,"preventionTips":["Only use origin strings, '*', 'skipper', or option objects as route values in config/cors.js","Lint config/cors.js against the documented schema","Review lift warnings after config changes"],"tags":["cors","config","routes","sails"],"backgroundTag":"invalid-cors-config","analyzedSha":"7b76422cc27823df033572bdda5c4910a68b697f","analyzedAt":"2026-09-01T04:01:57.104Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}