home / skills / openclaw / skills / cors-gen

cors-gen skill

safe

/skills/lxgicstudios/cors-gen

This skill generates precise CORS configurations for your stack from plain English descriptions, handling multiple origins and credentials for common

npx playbooks add skill openclaw/skills --skill cors-gen

Review the files below or copy the command above to add this skill to your agents.

Files (8)

SKILL.md

2.2 KB

---
name: cors-gen
description: Generate CORS configuration for your stack. Use when cross-origin requests are blocked.
---

# CORS Generator

CORS errors are the bane of frontend development. Describe your setup and get the exact configuration you need for your stack.

**One command. Zero config. Just works.**

## Quick Start

```bash
npx ai-cors "frontend on localhost:3000, API on localhost:8080"
```

## What It Does

- Generates CORS config for your specific server/framework
- Handles complex setups with multiple origins
- Includes credentials, headers, and method configuration
- Works with Express, Fastify, Next.js, and more

## Usage Examples

```bash
# Local development
npx ai-cors "frontend on localhost:3000, API on localhost:8080"

# Production setup
npx ai-cors "React app on vercel, Express API on Railway"

# Multiple origins
npx ai-cors "allow requests from app.example.com and admin.example.com"

# With credentials
npx ai-cors "frontend on vercel, API on heroku, needs cookies"
```

## Best Practices

- **Be specific about origins** - don't use * in production
- **Allow only needed methods** - GET, POST, not everything
- **Consider credentials** - cookies require specific config
- **Test in incognito** - browser caching can hide issues

## When to Use This

- "CORS blocked" errors in the console
- Setting up a new API endpoint
- Migrating frontend or backend to new domain
- Adding authentication to an existing API

## Part of the LXGIC Dev Toolkit

This is one of 110+ free developer tools built by LXGIC Studios. No paywalls, no sign-ups, no API keys on free tiers. Just tools that work.

**Find more:**
- GitHub: https://github.com/LXGIC-Studios
- Twitter: https://x.com/lxgicstudios
- Substack: https://lxgicstudios.substack.com
- Website: https://lxgic.dev

## Requirements

No install needed. Just run with npx. Node.js 18+ recommended. Needs OPENAI_API_KEY environment variable.

```bash
npx ai-cors --help
```

## How It Works

Takes your plain English description of your frontend and backend setup, then generates the correct CORS configuration for your server framework. The AI handles the nuances of preflight requests, allowed headers, and credential handling.

## License

MIT. Free forever. Use it however you want.

Overview

This skill generates ready-to-use CORS configuration for your stack from a plain-English description. It produces framework-specific snippets (Express, Fastify, Next.js, etc.) that include origins, methods, headers, and credential handling. Use it to quickly resolve cross-origin request failures without manual trial-and-error.

How this skill works

You describe your frontend and backend setup in simple text and the tool analyzes origins, required methods, and credential needs. It then outputs precise CORS config tailored to the chosen server/framework, including preflight handling and recommended header lists. The generator supports multiple origins and common hosting platforms to produce production-safe settings.

When to use it

You see "CORS blocked" errors in the browser console.
Setting up a new API endpoint that will be called from a different origin.
Migrating frontend or backend to a new domain or hosting provider.
Adding cookie-based authentication that requires credentials.
Creating a multi-origin setup for admin and public apps.

Best practices

Specify exact origins in production; avoid wildcard '*' for sensitive routes.
Allow only required HTTP methods instead of all methods.
Explicitly list allowed headers needed by your client to prevent preflight failures.
Enable credentials only when necessary and ensure Access-Control-Allow-Credentials is paired with a specific origin.
Test CORS changes in a private/incognito window to avoid cache interference.

Example use cases

Local development: generate config for frontend on localhost:3000 and API on localhost:8080.
Production deploy: produce CORS for a React app on Vercel calling an Express API on Railway.
Multiple origins: allow requests from app.example.com and admin.example.com with different permission sets.
Credentialed requests: configure cookies and authentication headers for cross-site login flows.
Framework-specific output: get ready-to-paste code snippets for Express, Fastify, or Next.js.

FAQ

Do I need to install anything to use this skill?

No install is required; run it via npx with Node.js 18+ and set your OPENAI_API_KEY environment variable.

Will it produce production-safe defaults?

Yes. It prefers specific origins and limited methods by default and warns against wildcards for production use.