57

What is the difference between res.setHeader and res.header. Which one should be used for enabling CORS? In some pages res.header is used and some pages res.setHeader is used for CORS.

shiva
  • 5,083
  • 5
  • 23
  • 42
Subham
  • 1,414
  • 4
  • 17
  • 34
  • Possible duplicate of [How to allow CORS in Express/Node.js?](http://stackoverflow.com/questions/7067966/how-to-allow-cors-in-express-node-js) – The Reason Nov 28 '16 at 09:31
  • I know how to allow CORS.But someplace it is written res.header and somewhere res.setHeader. – Subham Nov 28 '16 at 09:33

4 Answers4

107

res.setHeader() is a native method of Node.js and res.header() is an alias of res.set() method from Express framework.

Documentation: res.setHeader(), res.set()

This two methods do exactly the same thing, set the headers HTTP response. The only difference is res.setHeader() allows you only to set a singular header and res.header() will allow you to set multiple headers. So use the one fit with your needs.

Zagonine
  • 2,213
  • 3
  • 22
  • 29
  • 9
    This is not actually correct. `res.setHeader('X-Frame-Options','*')` will set a header `X-Frame-Options` with value `*`, while `res.header('X-Frame-Options','*')` will set a header `x-frame-options` with value `*`. However, since headers are technically case insensitive, this should be fine in most scenarios. – asleepysamurai Dec 12 '17 at 08:56
35

Perhaps an example can clarify more:

// only a single field is set 
res.setHeader('content-type', 'application/json');

// multiple fields can be set at once
res.set({
     'content-type': 'application/json',
     'content-length': '100',
     'warning': "with content type charset encoding will be added by default"
});
iLuvLogix
  • 5,920
  • 3
  • 26
  • 43
Ghafoor
  • 448
  • 5
  • 5
  • 5
    Note: should be "comma" instead of "colon" in `setHeader` example above – Nitin Bansal Oct 16 '17 at 11:34
  • Well comma is present among properties. The colon (:) is a way of javascript separating a value from its properties. So I know it is right. Please do check and let me know if the code doesn't work. Thanks – Ghafoor Oct 22 '17 at 17:32
  • 5
    @Ghafoor but node's native `res.setHeader` function (https://nodejs.org/docs/v0.4.0/api/http.html#response.setHeader) gets two arguments (`name`, `value` which are separated by comma). You might have confused it with one `object` argument (but even then the `{}` are missing). TL;DR: colon should be a comma – d2uX Oct 30 '17 at 08:00
6

Addition to high-voting answers, set is alias header which calls setHeader to set a header. here is the source code:

res.set =
res.header = function header(field, val) {
  if (arguments.length === 2) {
    var value = Array.isArray(val)
      ? val.map(String)
      : String(val);

    // add charset to content-type
    if (field.toLowerCase() === 'content-type') {
      if (Array.isArray(value)) {
        throw new TypeError('Content-Type cannot be set to an Array');
      }
      if (!charsetRegExp.test(value)) {
        var charset = mime.charsets.lookup(value.split(';')[0]);
        if (charset) value += '; charset=' + charset.toLowerCase();
      }
    }

    this.setHeader(field, value);
  } else {
    for (var key in field) {
      this.set(key, field[key]);
    }
  }
  return this;
};

Also see GitHub here

Pylon
  • 698
  • 6
  • 9
-4
app.use((req, res, next) => {
  res.setHeader("Access-Control-Allow-Origin", "*");
  res.setHeader(
    "Access-Control-Allow-Headers",
    "Origin, X-Requested-With, Content-Type, Accept"
  );
  res.setHeader(
    "Access-Control-Allow-Methods",
    "GET, POST, PATCH, DELETE, OPTIONS"
  );
  next();
});

I use this code for my mean stack projects.

Pingolin
  • 3,161
  • 6
  • 25
  • 40
Mostafa Mohammadi Panah
  • 41
  • 2