What is the difference between res.setHeader and res.header. Which one should be used for enabling CORS? In some pages res.header is used and some pages res.setHeader is used for CORS.
4 Answers
res.setHeader()
is a native method of Node.js and res.header()
is an alias of res.set()
method from Express framework.
Documentation:
res.setHeader()
,res.set()
This two methods do exactly the same thing, set the headers HTTP response. The only difference is res.setHeader()
allows you only to set a singular header and res.header()
will allow you to set multiple headers.
So use the one fit with your needs.
-
9This is not actually correct.
res.setHeader('X-Frame-Options','*')
will set a headerX-Frame-Options
with value*
, whileres.header('X-Frame-Options','*')
will set a headerx-frame-options
with value*
. However, since headers are technically case insensitive, this should be fine in most scenarios. Dec 12, 2017 at 8:56
Perhaps an example can clarify more:
// only a single field is set
res.setHeader('content-type', 'application/json');
// multiple fields can be set at once
res.set({
'content-type': 'application/json',
'content-length': '100',
'warning': "with content type charset encoding will be added by default"
});
-
5Note: should be "comma" instead of "colon" in
setHeader
example above Oct 16, 2017 at 11:34 -
Well comma is present among properties. The colon (:) is a way of javascript separating a value from its properties. So I know it is right. Please do check and let me know if the code doesn't work. Thanks– GhafoorOct 22, 2017 at 17:32
-
5@Ghafoor but node's native
res.setHeader
function (nodejs.org/docs/v0.4.0/api/http.html#response.setHeader) gets two arguments (name
,value
which are separated by comma). You might have confused it with oneobject
argument (but even then the{}
are missing). TL;DR: colon should be a comma– d2uXOct 30, 2017 at 8:00
Addition to high-voting answers, set
is alias header
which calls setHeader
to set a header. here is the source code:
res.set =
res.header = function header(field, val) {
if (arguments.length === 2) {
var value = Array.isArray(val)
? val.map(String)
: String(val);
// add charset to content-type
if (field.toLowerCase() === 'content-type') {
if (Array.isArray(value)) {
throw new TypeError('Content-Type cannot be set to an Array');
}
if (!charsetRegExp.test(value)) {
var charset = mime.charsets.lookup(value.split(';')[0]);
if (charset) value += '; charset=' + charset.toLowerCase();
}
}
this.setHeader(field, value);
} else {
for (var key in field) {
this.set(key, field[key]);
}
}
return this;
};
Also see GitHub here
app.use((req, res, next) => {
res.setHeader("Access-Control-Allow-Origin", "*");
res.setHeader(
"Access-Control-Allow-Headers",
"Origin, X-Requested-With, Content-Type, Accept"
);
res.setHeader(
"Access-Control-Allow-Methods",
"GET, POST, PATCH, DELETE, OPTIONS"
);
next();
});
I use this code for my mean stack projects.
-
-
-
I take this is to show how to tackle CORS error. Not a valid answer though– besthostJan 13, 2022 at 21:39