---
id: aiohttp-cors
version: "0.8.1"
license: Apache License, Version 2.0
license_treatment: permissive
maintenance: active
---

# aiohttp-cors — CORS support for aiohttp

License: permissive · Maintenance: active · Downloads: 19.2M/mo

## What it is and what it does

aiohttp_cors is a middleware library that implements the CORS standard for aiohttp, an async HTTP server framework. It solves the problem of allowing web browsers to make cross-origin requests to your server by handling the browser's same-origin policy restrictions through proper HTTP headers and preflight request handling. The library lets you configure which origins can access specific routes, whether credentials are allowed, which headers clients can send, and which headers the server exposes back to clients.

You configure CORS per route by wrapping resources and routes through the library's API, specifying allowed origins and their associated options. The package handles both simple requests (which include the Origin header) and preflight requests (OPTIONS method queries that browsers send before complex requests). It supports wildcard origins for permissive configurations and per-origin customization for fine-grained control.

Use it for:

- Enable a single-page application served from a different domain to make API calls to your aiohttp server.
- Allow mobile apps or desktop clients to access your async HTTP API without browser same-origin restrictions.
- Configure different CORS policies for different routes—strict for sensitive endpoints, permissive for public APIs.
- Handle preflight caching to reduce browser OPTIONS requests and improve client-side performance.
- Expose custom response headers to browser clients while controlling which request headers are accepted.

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

Adds Cross-Origin Resource Sharing (CORS) support to aiohttp applications, enabling controlled cross-origin HTTP requests from browsers by configuring which origins can access specific routes and what credentials and headers are allowed.

Yes, if you are building an aiohttp application that needs to serve cross-origin requests from browsers. The package has low install friction, active maintenance, permissive licensing, and no known vulnerabilities. The Alpha status reflects the library's maturity rather than instability—it has been in use since 2015. Install it when you need CORS support; skip it if your API is same-origin only or uses alternative cross-origin strategies.

## Install

pip install aiohttp-cors
uv add aiohttp-cors
poetry add aiohttp-cors

## Installing aiohttp-cors

Before you install: Low install friction with a single runtime dependency on aiohttp. The package is actively maintained with a recent release in March 2025 and ongoing repository activity, though classified as Alpha development status.

License in practice: Licensed under Apache License 2.0 (permissive), allowing commercial and private use with minimal restrictions—suitable for most projects that can accommodate attribution.

Quickstart:

pip install aiohttp-cors

import aiohttp_cors
from aiohttp import web

app = web.Application()
cors = aiohttp_cors.setup(app)
resource = cors.add(app.router.add_resource("/hello"))
cors.add(resource.add_route("GET", handler), {
    "http://client.example.org": aiohttp_cors.ResourceOptions(
        allow_credentials=True,
        expose_headers=("X-Custom-Server-Header",),
    )
})

Requires Python 3.9 or later and an existing aiohttp application to configure.

Verify before relying:

- Whether the Alpha development status reflects active feature development or stable maintenance with conservative versioning.
- Performance characteristics when handling high volumes of preflight requests or complex CORS configurations.

## Package facts

- License: Apache License, Version 2.0 (permissive)
- Python support: supports_current
- Install friction: low
- Maintenance: active
- Downloads: 19.2M/month (top 5,000 on PyPI)
- Known vulnerabilities: none known

## Tags

aiohttp cors middleware, cross-origin resource sharing async, browser cors headers aiohttp, aiohttp preflight requests, cors configuration aiohttp routes, same-origin policy override, aiohttp access control headers, async-http, browser-security, middleware

[View on SkillFed](https://skillfed.io/packages/aiohttp-cors) · [View on PyPI](https://pypi.org/project/aiohttp-cors/)