title: socket.io CORS access-control-allowed-origin is set to *
body: <p>The security department of the company I work for is against (rightly so) <code>Access-Control-Allow-Origin: *</code> on the socket.io requests.</p>
  
  <p>The app is not using CORS at all, this is the problem only with socket.io requests.</p>
  
  <p>This is the function I am using to start socket.io after the server is ready:</p>
  
  <pre><code>exports.start = (server) =&gt; {
      io = exports.socketio.socket.listen(server, {
          origins: `https://${server.address().address}:*`,
          rejectUnauthorized: false,
          wsEngine: 'ws',
          transports: ['websocket', 'polling']
      });
  
      exports.connect();
  };
  </code></pre>
  
  <p>The issue with that is that first:
  - <code>server.address().address</code> returns something like this <code>::</code>
  - I need to deploy the app on multiple servers with different addresses
  - previously there was no <code>origins</code> property and socket.io was setting the origing to <code>*</code></p>
  
  <p><strong>- when I test the solution on my local machine setting the <code>origins to: 'https://localhost:3000'</code> I am still getting <code>Access-Controll-Allow-Origin: *</code></strong> for some socket.io requests.</p>
  
  <p><a href="https://i.stack.imgur.com/7VHlQ.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/7VHlQ.png" alt="enter image description here"></a></p>
  
  <p>Has someone already encountered this issue ? </p>
  
  <p>Any help much appreciated </p>