const path = require('path');
const favicon = require('serve-favicon');
const compress = require('compression');
const cors = require('cors');
const helmet = require('helmet');
const logger = require('winston');

const feathers = require('@feathersjs/feathers');
const configuration = require('@feathersjs/configuration');
const express = require('@feathersjs/express');
<% if (hasProvider('socketio')) { %>const socketio = require('@feathersjs/socketio');<% } %>
<% if (hasProvider('primus')) { %>const primus = require('@feathersjs/primus');<% } %>

const middleware = require('./middleware');
const services = require('./services');
const appHooks = require('./app.hooks');
const channels = require('./channels');

const app = express(feathers());

// Load app configuration
app.configure(configuration());
// Enable CORS, security, compression, favicon and body parsing
app.use(cors());
app.use(helmet());
app.use(compress());
app.use(express.json());
app.use(express.urlencoded({ extended: true }));
app.use(favicon(path.join(app.get('public'), 'favicon.ico')));
// Host the public folder
app.use('/', express.static(app.get('public')));

// Set up Plugins and providers
<% if (hasProvider('rest')) { %>app.configure(express.rest());<% } %>
<% if (hasProvider('socketio')) { %>app.configure(socketio());<% } %>
<% if(hasProvider('primus')) { %>app.configure(primus({ transformer: 'websockets' }));<% } %>
// Configure other middleware (see `middleware/index.js`)
app.configure(middleware);
// Set up our services (see `services/index.js`)
app.configure(services);
// Set up event channels (see channels.js)
app.configure(channels);

// Configure a middleware for 404s and the error handler
app.use(express.notFound());
app.use(express.errorHandler({ logger }));

app.hooks(appHooks);

module.exports = app;

@@ -112,20 +112,22 @@
 ;%0Aconst 
-cors
+helmet
  = requi
@@ -130,20 +130,22 @@
 equire('
-cors
+helmet
 ');%0Acons
@@ -138,38 +138,36 @@
 helmet');%0Aconst 
-helmet
+cors
  = require('helm
@@ -154,38 +154,36 @@
 cors = require('
-helmet
+cors
 ');%0Aconst logger
@@ -816,14 +816,8 @@
 able
- CORS,
  sec
@@ -822,16 +822,22 @@
 ecurity,
+ CORS,
  compres
@@ -875,20 +875,22 @@
 app.use(
-cors
+helmet
 ());%0Aapp
@@ -886,38 +886,36 @@
 met());%0Aapp.use(
-helmet
+cors
 ());%0Aapp.use(com

Use cors after helmet. (#351)