Flask-CORS

Flask-CORS is a small Flask extension that adds Cross-Origin Resource Sharing (CORS) headers to your application’s responses, letting browsers make cross-domain AJAX requests to your API. Rather than manually wiring Access-Control-* headers into every view, you attach the CORS extension to your app (or use the @cross_origin decorator on individual routes) and configure allowed origins, methods, headers, and credential behavior once.

It supports per-resource configuration via regular-expression path matching, so a single app can apply different CORS policies to different route groups (e.g. a public /api/v1/* versus an internal /admin/*). It also wraps Flask’s exception handlers so CORS headers are still applied to error responses, and exposes a vary_header and private-network-access support for modern browser CORS preflight behavior.

What You Get

• A CORS extension class that can be applied app-wide or per-Blueprint via app.route/Blueprint support
• A @cross_origin decorator for applying CORS rules to individual view functions
• Per-resource configuration via regex path patterns, each with its own origins/methods/headers/credentials settings
• Automatic wrapping of Flask’s exception handlers so error responses also carry CORS headers
• Support for Access-Control-Allow-Private-Network and Vary: Origin for modern browser CORS semantics

Common Use Cases

• Enabling a Flask REST API to be called from a separately-hosted single-page app (React/Vue) on a different origin
• Applying different CORS policies to different route groups, e.g. permissive for /api/public/* and locked-down for /api/admin/*
• Allowing authenticated cross-origin requests (cookies/credentials) from a known set of trusted origins
• Adding CORS headers to error responses (4xx/5xx) so frontend error handling still works across origins

Under The Hood

Architecture - Flask-CORS splits into three modules: core.py holds pure option-resolution logic (merging app config, constructor kwargs, and per-resource overrides into a frozen _ComputedCorsOptions dataclass, then serializing it into response headers via set_cors_headers), extension.py wires the CORS class into Flask’s after_request hook and wraps handle_exception/handle_user_exception so error responses also get headers, and decorator.py exposes the equivalent @cross_origin per-view API built on the same core primitives. Resource patterns are regexes sorted longest-to-shortest so the most specific path wins when multiple patterns match. Tech Stack - Pure Python (98% of the codebase) with Flask and Werkzeug as the only runtime dependencies (flask>=0.9, Werkzeug>=0.7), plus typing_extensions for Unpack on Python <3.11; packaged with a pyproject.toml/uv-based build, and CI runs against Python 3.9-3.13. Code Quality - Extensive, well-organized test suite (tests/core, tests/decorator, tests/extension, tests/typecheck) covering origin/header/method matching, credentials, private-network headers, vary-header behavior, and exception interception; type hints are used throughout with TypedDict/Unpack for precise kwarg typing, and inline comments explain non-obvious merge-order and regex-matching decisions. API Design - The dual API (extension-style CORS(app) for whole-app defaults, decorator-style @cross_origin() for per-route overrides) covers both common usage patterns with a single, consistent options vocabulary (origins, methods, allow_headers, supports_credentials, etc.), keeping the barrier to a working CORS setup down to one line of code.