cors plugin error

[ThinhPhoenix]

What version of Elysia is running?

No response

What platform is your computer?

No response

What steps can reproduce the bug?

What is the expected behavior?

No response

What do you see instead?

No response

Additional information

No response

Have you try removing the node_modules and bun.lockb and try again yet?

No response

[cryolynx]

There is a workaround which is to set the Access-Control-Allow-Origin header in the .onAfterHandle() hook. For example

app.onAfterHandle(({ request, set }) => {
    const origin = request.headers.get("origin");

    if (origin === "http://localhost:5173") {
      set.headers["Access-Control-Allow-Origin"] = origin;
    }
});

[ArnauNau]

There is a workaround which is to set the Access-Control-Allow-Origin header in the .onAfterHandle() hook. For example

The workaround is to literally not use the cors plugin. I've been banging my head on the table thinking I was doing something wrong but got to an example so simple and then I came to find this.

[darkyelox]

This is happening to me and I have lost hours trying to figure it out, so the plugin is useless right now.

UPDATE:
I solved it by removing the bun.lock and node_modules and install again, weird form to solve this problem, someone knows why this happens?

[jasperdunn]

I solved it by removing the bun.lock and node_modules and install again

Fantastic thanks! [Edit] I tried this but my tests are still flaky due to the CORs error.

Even using the work-around I had this issue break random e2e tests, I've spent hours troubleshooting this. I guess the plugin isn't the problem afterall 🤔

Going to try the plugin again.

[jasperdunn]

cors({
          origin: env.CLIENT_URL,
          aot: false,
          credentials: true,
          methods: ['GET', 'POST', 'DELETE', 'OPTIONS', 'HEAD'],
          allowedHeaders: [
            'Content-Type',
            'Authorization',
          ],
        }),

Even with the removal of bun.lock and node_modules, using the plugin I'm getting this error every time:

Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at http://localhost:8787/auth. (Reason: expected ‘true’ in CORS header ‘Access-Control-Allow-Credentials’).

Going back to the work around, but I still get random cases where I get a CORs error here too.

[dylan1951]

Guys what the actual hell I almost threw my laptop out the window.

I solved it by removing the bun.lock and node_modules and install again

This worked for me but damn kind of wishing I just used express at this point

[tobiaskraus]

I solved it by removing the bun.lock and node_modules and install again

Worked. For me the fresh bun.lock showed no changes for "@elysiajs/cors" (stayed at 1.4.0),
but "elysia"changed from 1.3.6. (from July 24 2025) to 1.4.9. (Sept 30 2025).

One of these versions of between fixed the issue.

[yandzee]

One of the possible reasons of getting that error is that your code does things like this:

ctx.set.headers = { ... }

which removes all the headers CORS set before your code executed.

[r4zendev]

One of the possible reasons of getting that error is that your code does things like this:

ctx.set.headers = { ... }
which removes all the headers CORS set before your code executed.

This was super helpful and fixed the issue on my side. However, there are type errors when I'm trying to do something like:
set.headers = { ...set.headers, ... }
Probably should be possible to do so by default without explicit type-casting or at least have an option to use custom setter for this property that would include the old headers or something. Right now the only option is to cast explicitly to Record<string, string | number>

[SkandarS0]

@jasperdunn same, the server is returning true, true as a value for that header