home / skills / openclaw / skills / cors-config-gen

cors-config-gen skill

safe

This skill generates precise CORS configurations from plain descriptions, helping you resolve cross-origin blocks across frameworks with minimal effort.

npx playbooks add skill openclaw/skills --skill cors-config-gen

Review the files below or copy the command above to add this skill to your agents.

Files (8)

SKILL.md

2.2 KB

---
name: cors-gen
description: Generate CORS configuration for your stack. Use when cross-origin requests are blocked.
---

# CORS Generator

CORS errors are the bane of frontend development. Describe your setup and get the exact configuration you need for your stack.

**One command. Zero config. Just works.**

## Quick Start

```bash
npx ai-cors "frontend on localhost:3000, API on localhost:8080"
```

## What It Does

- Generates CORS config for your specific server/framework
- Handles complex setups with multiple origins
- Includes credentials, headers, and method configuration
- Works with Express, Fastify, Next.js, and more

## Usage Examples

```bash
# Local development
npx ai-cors "frontend on localhost:3000, API on localhost:8080"

# Production setup
npx ai-cors "React app on vercel, Express API on Railway"

# Multiple origins
npx ai-cors "allow requests from app.example.com and admin.example.com"

# With credentials
npx ai-cors "frontend on vercel, API on heroku, needs cookies"
```

## Best Practices

- **Be specific about origins** - don't use * in production
- **Allow only needed methods** - GET, POST, not everything
- **Consider credentials** - cookies require specific config
- **Test in incognito** - browser caching can hide issues

## When to Use This

- "CORS blocked" errors in the console
- Setting up a new API endpoint
- Migrating frontend or backend to new domain
- Adding authentication to an existing API

## Part of the LXGIC Dev Toolkit

This is one of 110+ free developer tools built by LXGIC Studios. No paywalls, no sign-ups, no API keys on free tiers. Just tools that work.

**Find more:**
- GitHub: https://github.com/LXGIC-Studios
- Twitter: https://x.com/lxgicstudios
- Substack: https://lxgicstudios.substack.com
- Website: https://lxgicstudios.com

## Requirements

No install needed. Just run with npx. Node.js 18+ recommended. Needs OPENAI_API_KEY environment variable.

```bash
npx ai-cors --help
```

## How It Works

Takes your plain English description of your frontend and backend setup, then generates the correct CORS configuration for your server framework. The AI handles the nuances of preflight requests, allowed headers, and credential handling.

## License

MIT. Free forever. Use it however you want.

Overview

This skill generates precise CORS configuration tailored to your stack so cross-origin requests stop being a blocker. Describe your frontend and backend topology and get ready-to-use config for Express, Fastify, Next.js, and other servers. It focuses on secure defaults and handles credentials, methods, and headers automatically.

How this skill works

You provide a plain-English description of your frontend and API locations (local, domains, or hosting platforms). The skill analyzes origins, credentials needs, and required methods/headers, then outputs exact CORS snippets and settings for the detected framework. It also covers preflight handling and multi-origin setups.

When to use it

When browser console shows CORS blocked errors during development or production
When deploying frontend or backend to a new domain or hosting provider
When adding authentication or cookies that require credentialed requests
When consolidating or hardening allowed methods and headers for security
When supporting multiple origins (e.g., apps and admin panels) from one API

Best practices

Specify exact origins for production; avoid wildcards (*) for security
Allow only the HTTP methods your endpoints actually need (e.g., GET, POST)
Enable credentials only when required and ensure Access-Control-Allow-Origin is not a wildcard
Include only needed request headers to reduce the attack surface
Test CORS changes in a fresh browser session (incognito) to avoid cache interference

Example use cases

Local development: frontend on localhost:3000 and API on localhost:8080 — get dev-ready CORS for Express
Production: React app on Vercel with an Express API on Railway — generate secure production settings
Multiple origins: allow requests from app.example.com and admin.example.com with specific methods
Credentials: enable cookie-based auth across domains with proper Access-Control-Allow-Credentials and origin logic
Framework switch: get code snippets for Express, Fastify, or Next.js depending on your stack

FAQ

Does this require installation?

No install is required; run it with npx. Node.js 18+ is recommended.

Can it handle multiple origins and credentials?

Yes. It produces correct multi-origin handling and credential-safe configs, avoiding wildcard origins when credentials are enabled.