A Flask extension for handling Cross Origin Resource Sharing (CORS), making cross-origin AJAX possible.
This package has a simple philosophy: when you want to enable CORS, you wish to enable it for all use cases on a domain. This means no mucking around with different allowed headers, methods, etc.
By default, submission of cookies across domains is disabled due to the security implications. Please see the documentation for how to enable credential’ed requests, and please make sure you add some sort of CSRF protection before doing so!
Installation
Install the extension with using pip, or easy_install.
$ pip install -U flask-corsUsage
This package exposes a Flask extension which by default enables CORS support on all routes, for all origins and methods. It allows parameterization of all CORS headers on a per-resource level. The package also contains a decorator, for those who prefer this approach.
Simple Usage
In the simplest case, initialize the Flask-Cors extension with default arguments in order to allow CORS for all domains on all routes. See the full list of options in the documentation.
from flask import Flask
from flask_cors import CORS
app = Flask(__name__)
CORS(app)
@app.route("/")
def helloWorld():
return "Hello, cross-origin-world!"Resource specific CORS
Alternatively, you can specify CORS options on a resource and origin level of granularity by passing a dictionary as the resources option, mapping paths to a set of options. See the full list of options in the documentation.
app = Flask(__name__)
cors = CORS(app, resources={r"/api/*": {"origins": "*"}})
@app.route("/api/v1/users")
def list_users():
return "user example"Route specific CORS via decorator
This extension also exposes a simple decorator to decorate flask routes with. Simply add @cross_origin() below a call to Flask’s @app.route(..) to allow CORS on a given route. See the full list of options in the decorator documentation.
@app.route("/")
@cross_origin()
def helloWorld():
return "Hello, cross-origin-world!"Documentation
For a full list of options, please see the full documentation
Troubleshooting
If things aren’t working as you expect, enable logging to help understand what is going on under the hood, and why.
logging.getLogger('flask_cors').level = logging.DEBUGSet Up Your Development Environment — The development environment uses uv for Python version management as well as dependency management. There are helpful Makefile targets to do everything you need. Use make test to get started!
Contributing
Questions, comments or improvements? Please create an issue on Github, tweet at @corydolphin or send me an email. I do my best to include every contribution proposed in any way that I can.
Credits
This Flask extension is based upon the Decorator for the HTTP Access Control written by Armin Ronacher.
2 maintainers
Release files for flask-cors 6.0.5
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | |
|---|---|---|---|
| flask_cors-6.0.5.tar.gz | 101.4 kB | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| flask_cors-6.0.5-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 118.1 kB
Release files / flask_cors-6.0.5.tar.gz
| Download URL | flask_cors-6.0.5.tar.gz |
|---|---|
| Size | 101.4 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
30c5031552cd59f620ac0c8211dac45b345d3b2df310e7721879e4f46ef9c601
|
|
BLAKE2b-256 checksum How to use checksums |
47034e464a50860f9adf08b5c1d3479cb8ea1f12af2aa69535c7042c6e628135
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/6.1.0 CPython/3.13.13
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Jun 8, 2026.
Transparency logRelease files / flask_cors-6.0.5-py3-none-any.whl
| Download URL | flask_cors-6.0.5-py3-none-any.whl |
|---|---|
| Size | 16.7 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
68fcf75693e961f3af26683b23c4b9a8fb6b64de17d20d0c37b95e8de7ab2ed8
|
|
BLAKE2b-256 checksum How to use checksums |
49555bb1a2d918e9f02f131e47a59032bae70e48050e986e941511fd737a935c
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/6.1.0 CPython/3.13.13
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Jun 8, 2026.
Transparency log
