balderdashy/sails · warning

Invalid CORS settings for route ${route}

Error message

Invalid CORS settings for route ${route}

What it means

The CORS hook iterates the configured routes in `sails.config.cors.routes`; each entry's value must be a recognized CORS config (e.g. a string origin like 'http://example.com', '*', an object of CORS options, or 'skipper'). If the value is something unrecognized, the hook logs this warning and skips binding the CORS headers route for that path, leaving the route without CORS headers.

Source

Thrown at lib/hooks/security/cors/index.js:95

        // Else if cors is set to a string, use that has the origin
        else if (typeof routeCorsConfig === 'string') {
          optionsRouteConfigs[path][verb || 'default'] = _.extend({allowOrigins: [routeCorsConfig]});
          sails.router.bind(route, setHeaders(_.extend({}, sails.config.security.cors, {allowOrigins: [routeCorsConfig], methods: verb})), null, {_middlewareType: 'CORS HOOK: setHeaders'});
        }

        // Else if cors is an object, use that as the config
        else if (_.isPlainObject(routeCorsConfig)) {

          // Set configuration for the preflight OPTIONS request for this route.
          optionsRouteConfigs[path][verb || 'default'] = routeCorsConfig;

          // Bind a route that will set CORS headers for this url/path combo.
          sails.router.bind(route, setHeaders(_.extend({}, routeCorsConfig)), null, {_middlewareType: 'CORS HOOK: setHeaders'});
        }

        // Otherwise we don't recognize the CORS config, so throw a warning
        else {
          sails.log.warn('Invalid CORS settings for route '+route);
        }

      });

      // Now that we have `optionsRouteConfigs`, a list of all of the routes that (possibly) need
      // to be preflighted, construct a route that will handle OPTIONS requests for all of those routes.
      // Sending the result of `setPreflightConfig` (a function) into `setHeaders` will cause `setHeaders`
      // to run the function in order to determine the CORS options to use.
      sails.router.bind('options /*', setHeaders(setPreflightConfig(optionsRouteConfigs, sails.config.security.cors)), 'options', {_middlewareType: 'CORS HOOK: preflight'});

    });


    // Continue loading this Sails app.
    return;

  };

View on GitHub (pinned to 7b76422cc2)

Solutions

1. Change the route's value to a valid origin string, '*', 'skipper', or a CORS options object
2. Validate config/cors.js against the Sails 1.x CORS documentation schema
3. Check the lift logs for other CORS warnings to catch all bad entries at once

Example fix

// before
routes: { '/api/*': true }
// after
routes: { '/api/*': 'http://example.com' }

const VALID = (v) => typeof v === 'string' || (v && typeof v === 'object' && !Array.isArray(v));
for (const [route, cfg] of Object.entries(sails.config.cors.routes || {})) {
  if (!VALID(cfg)) console.warn(`Invalid CORS settings for route ${route}`);
}

function isValidCorsConfig(v) {
  return typeof v === 'string' || (v !== null && typeof v === 'object');
}

When it happens

Trigger: Setting a route entry in `sails.config.cors.routes` to an invalid value such as `'/foo': true`, `'/foo': 123`, or a typo'd string, then lifting the app.

Common situations: Typos in the origin string, boolean/numeric values instead of origin strings, copy-pasted config from older Sails 0.12 docs into Sails 1.x.

Related errors

• Cannot call res.render() - `req._sails.renderView` was not a
• i18n hook has disabled itself due to misconfiguration -- ret
• A leading `.` is not required in the config.views.extension
• Warning: route `${address}` should explicitly declare `skipA
• The 2-ary usage of `res.redirect()` is no longer supported i

AI-assisted analysis of balderdashy/sails@7b76422cc2 (2026-09-01). Data as JSON: /api/errors/9c6af00451754201. Report an issue: GitHub.