Logger and CORS

loggerMiddleware

Logs one line per request with the timestamp, method, path, status and duration.

import { loggerMiddleware } from 'riser-bob' bob.spongUse(loggerMiddleware)

[RiserBob] 2026-01-01T12:00:00.000Z | GET /users | 200 | 1.42ms

If something throws further down the chain, the logger prints the error and rethrows it so the central error handler can answer. A request that fails this way is logged with status 500.

corsMiddleware

Adds the CORS headers a browser needs to call your API from another origin.

import { corsMiddleware } from 'riser-bob' bob.spongUse(  corsMiddleware({    origin: ['http://localhost:5173'],    credentials: true,  }))

origin can be one string, such as 'http://localhost:5173', a list of origins, or '*'.

• Headers are only added when the request origin is allowed.
• When origin is not '*', the response includes Vary: Origin.
• Invalid options throw a TypeError when the middleware is created, not on the first request. This covers '*' with credentials, an empty methods list, and a maxAge that is not a non-negative integer.
• Preflight OPTIONS requests are answered by the server before routing. See Routing.

Order matters

Register both with spongUse before any route. A common setup is CORS first, then the logger:

const bob = new RiserBob(); bob.spongUse(  corsMiddleware({    origin: "http://localhost:5173",    credentials: true,  }),);bob.spongUse(loggerMiddleware); bob.spongGet("/", (spongReq, spongRes) => spongRes.send("Welcome"));

When a browser app on another origin sends cookies, the front end must also opt in, for example fetch(url, { credentials: 'include' }).