CORS Proxy for Cloudflare Workers

A simple and lightweight CORS proxy built for Cloudflare Workers that allows you to make cross-origin requests to any URL.

Features

• ✅ Handles all HTTP methods (GET, POST, PUT, DELETE, etc.)
• ✅ Supports CORS preflight requests
• ✅ Two URL formats for flexibility
• ✅ Simple usage page when accessed directly
• ✅ Error handling with proper status codes
• ✅ Lightweight and fast

Quick Start

1. Prerequisites

• Node.js installed
• Cloudflare account
• Wrangler CLI installed globally: npm install -g wrangler

2. Setup

# Install dependencies
npm install

# Login to Cloudflare (if not already done)
wrangler login

# Deploy to Cloudflare Workers
npm run deploy

3. Usage

Once deployed, you can use the proxy as follows:

https://your-worker.your-subdomain.workers.dev/?url=https://api.example.com/data

4. JavaScript Example

// Using fetch with the proxy
fetch(
  "https://your-worker.your-subdomain.workers.dev/?url=https://api.example.com/data"
)
  .then((response) => response.json())
  .then((data) => console.log(data))
  .catch((error) => console.error("Error:", error));

// POST request example
fetch(
  "https://your-worker.your-subdomain.workers.dev/?url=https://api.example.com/submit",
  {
    method: "POST",
    headers: {
      "Content-Type": "application/json",
    },
    body: JSON.stringify({ key: "value" }),
  }
)
  .then((response) => response.json())
  .then((data) => console.log(data));

Development

# Start local development server
npm run dev

# Deploy to production
npm run deploy

How it Works

1. The worker receives a request with a target URL
2. It extracts the target URL from either query parameter or path
3. Creates a new request to the target URL
4. Fetches the response from the target
5. Returns the response with proper CORS headers added

CORS Headers Added

• Access-Control-Allow-Origin: *
• Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS
• Access-Control-Allow-Headers: *
• Access-Control-Max-Age: 86400

Security Considerations

This proxy allows requests to ANY URL. In production, consider:

• Implementing URL whitelist/blacklist
• Adding rate limiting
• Authentication/API key requirements
• Logging for monitoring

License

MIT