flask-cors

A Flask extension simplifying CORS support

flask-cors Permissive license MIT Active ★ 932 v6.0.5 released 2026-06-08

Install

flask-cors on PyPI

pip

pip install flask-cors

uv

uv add flask-cors

poetry

poetry add flask-cors

Package facts

License	MIT (permissive)
Python support	supports the current Python release (<4.0,>=3.9)
Install friction	low — pure-Python wheel
Runtime dependencies	3 — flask, Werkzeug, typing_extensions
Maintenance	actively maintained — 66 days since the last release
Last repo commit	2026-06-09
First released	2013-07-28
Popularity	one of the top 1,000 most-downloaded packages on PyPI (30-day window, as of 2026-08-13)
Known vulnerabilities	none known (OSV.dev, checked 2026-08-13)

Evidence: flask_cors-6.0.5-py3-none-any.whl

Keywords: python

Intended Audience :: DevelopersProgramming Language :: PythonProgramming Language :: Python :: 3Programming Language :: Python :: 3.10Programming Language :: Python :: 3.11Programming Language :: Python :: 3.12Programming Language :: Python :: 3.13Programming Language :: Python :: 3.9Topic :: Software Development :: Libraries :: Python Modules

About flask-cors

from the package's own PyPI description — quoted content, verbatim

Flask-CORS

A Flask extension for handling Cross Origin Resource Sharing (CORS), making cross-origin AJAX possible.

This package has a simple philosophy: when you want to enable CORS, you wish to enable it for all use cases on a domain. This means no mucking around with different allowed headers, methods, etc.

By default, submission of cookies across domains is disabled due to the security implications. Please see the documentation for how to enable credential'ed requests, and please make sure you add some sort of CSRF <http://en.wikipedia.org/wiki/Cross-site_request_forgery>__ protection before doing so!

Installation

Install the extension with using pip, or easy_install.

.. code:: bash

$ pip install -U flask-cors

Usage

This package exposes a Flask extension which by default enables CORS support on all routes, for all origins and methods. It allows parameterization of all CORS headers on a per-resource level. The package also contains a decorator, for those who prefer this approach.

Simple Usage ~~~~~~~~~~~~

In the simplest case, initialize the Flask-Cors...

Read as markdown · JSON record · Source repository · Homepage · Docs

AI interpretation — verify before relying

AI-generated interpretation of the package facts above; every digit, version, license, or vulnerability id it cites is grounded in the facts already shown on this page

Flask-CORS is a Flask extension that enables Cross-Origin Resource Sharing (CORS) on web routes, allowing cross-origin AJAX requests with configurable per-resource or global policies.

Low friction install with only three runtime dependencies (flask, Werkzeug, typing_extensions). Actively maintained with a recent release 66 days ago and ongoing repository activity.

MIT license permits commercial and private use with minimal restrictions, requiring only attribution and inclusion of the license notice.

Usage

pip install flask-cors

from flask import Flask
from flask_cors import CORS

app = Flask(__name__)
CORS(app)

@app.route('/')
def hello():
    return 'Hello, cross-origin-world!'

Requires Python 3.9 or later (supports 3.9–3.13); Flask must be installed and running.

Verdict: Flask-CORS is a well-maintained, permissively licensed extension for handling CORS in Flask applications with minimal dependencies and no known vulnerabilities. It's suitable for production use with straightforward setup and flexible per-route or global configuration.

Needs verification

Whether the package's default CORS policy (all origins, all methods) is appropriate for your security model without additional configuration.
Performance characteristics under high request volume or with complex resource-specific CORS rules.

flask cors extensioncross origin resource sharingcross-origin ajax requestscors headers flaskenable cors flask appcross-domain requests pythonflask cors decorator