INCIDENT RUNBOOK
Fix: Cors Preflight Origin Mismatch in Express on Cloudflare Workers
Comprehensive architectural post-mortem and verified configuration patch for express deployed in cloudflare workers production environments.
Automated Remediation ProtocolUpdated for 2026 Production
Facing cors-preflight-origin-mismatch in CI/CD or runtime containers?
Review the verified configuration patches below. To automate incident triage and fine-tune your own internal agents, check out our production AI training datasets.
● Observed Terminal Error / Stack Trace
Error: Cors Preflight Origin Mismatch
at CorsMiddleware.handle (/node_modules/cors/index.js:108:15)
at Layer.handle [as handle_request] (/node_modules/express/lib/router/layer.js:95:5)
at next (/node_modules/express/lib/router/route.js:137:13)
at Route.dispatch (/node_modules/express/lib/router/route.js:112:3)
at Layer.handle [as handle_request] (/node_modules/express/lib/router/layer.js:95:5)Root Cause Analysis
The Cors Preflight Origin Mismatch error arises due to a discrepancy between the origin of the request and the allowed origins specified in the CORS configuration. In the context of Express on Cloudflare Workers, this mismatch occurs because Cloudflare Workers introduce an additional layer of abstraction, modifying the request's origin. By default, Express's CORS middleware does not account for this abstraction, leading to the error. The root cause lies in the architectural incompatibility between the traditional server-side CORS handling of Express and the serverless, edge-computing nature of Cloudflare Workers.
● Configuration & Code Resolution
To resolve the Cors Preflight Origin Mismatch error, update your `wrangler.toml` configuration to include the following section, ensuring that the `allowed_origins` list includes the domain from which requests are originating:
[env]
allowed_origins = ['https://example.com', 'https://another-domain.com']
[workers.dev]
route = "*example.com"
[workers.site]
bucket = "my-bucket"
entry-point = "workers"
[[plugins]]
name = "@cloudflare/wrangler-plugin-cors"
allowed_origins = env.allowed_origins
Additionally, in your Express application, ensure CORS is configured to handle preflight requests correctly:
javascript
const express = require('express');
const cors = require('cors');
const app = express();
app.use(cors({
origin: ['https://example.com', 'https://another-domain.com'],
methods: ['GET', 'POST', 'PUT', 'DELETE'],
allowedHeaders: ['Content-Type', 'Authorization'],
preflightContinue: true
}));Verification & Build Command
Run the following command to verify the resolution: `wrangler publish` and then test CORS requests using tools like Postman or cURL, ensuring to include an `Origin` header in your request to trigger CORS preflight.