router VS Hapi

Oak is a middleware framework for Deno’s native HTTP server and Deno Deploy. It is influenced by Koa (hence the anagram) and includes a middleware router inspired by @koa/router.

The cookie part is crucial, but the CORS really depends on the implementation on bank.com. When sending an AJAX request to another domain, browsers first send a pre-flight OPTION request, to check the CORS rules on the destination domain. Only if the CORS works out will the browser send the "real" request. If bank.com implements a proper OPTION endpoint on /transfer that doesn't start any transfers, but just returns the CORS headers, the "real" transfer won't be called. It payes off to be redundant with security, so having both of these is good. If you're using Koa, koa-router has allowed methods to easily expose an OPTIONS endpoint for all other existing endpoints.

I tend to use hapi (https://hapi.dev) instead of Express if I need to write a quick backend for something these days.

Fastify looks nice too but I haven't used it.

Been burnt by full-stack frameworks in the past (e.g. Meteor) but they can be a good option for some.

Hapi.js commonly referred to as "hapi," is an open-source web application framework for building web and application server systems in Node.js. It was created by Walmart Labs and is designed to provide a flexible and robust foundation for building web applications, APIs, and other networked software.

Restify & Fastify Hapi

Hapi.js: https://hapi.dev/

Hapi – The Simple, Secure Framework Developers Trust

Hapi.js is one of the best Node.js web framework, which is used for developing application program interfaces. Thanks to a strong plugin system Hapi.js, you can fully manage the development process. Hapi.js motivates the devel­oper to focus on the reuse logic instead of spending time building the infrastructure.

does not seem so https://github.com/hapijs/hapi/releases/tag/v21.0.0 (ok, I'm nitpicking on that one)

Joi validator used to be part of hapi but then became a standalone library that you can use everywhere where validation is needed. So for example, here's how username validation can be done: