# Allow cross-origin requests with CORS

> Call CORS() to allow one origin, several origins or every origin to use your routes from a browser.

Framework: total5
Product: Total.js 5 (total5@0.0.19)
Language: en
Content-SHA256: 19d1e5e05b9e75f6423fa945f690b5f170fcdc1065d0ecbc59ba4271dd30724d
Snapshot: c0700e321579725c5cf4f5ace1ad7d2866d1b4f93c24a63c0b41b6b7998e976c
Sources: total5-installed@total5@0.0.19
Review: not-recorded

Browsers block requests from other origins unless the server allows them. `CORS(origin)` sets the allowed origins for the whole app: pass an address, a comma-separated list, or nothing to allow every origin (`*`). Prefix an address with `+` to add it to the existing list.

```js definitions/cors.js
CORS('https://app.example.com');
```

```js controllers/api.js
exports.install = function() {
	ROUTE('GET /api/time/', ($) => $.json({ ok: true }));
};
```