CORS Configuration
Configuration reference for the CORS plugin (`cors`): the parameters and plugin metadata, each attribute with its type, whether it is required, its default and its accepted values.
Parameters
See plugin common configurations (opens in Apache APISIX docs) for configuration options available to all plugins.
allow_origins — string · optional · default: * · since APISIX 1.2 · API7 Gateway 3.2.16.4
Comma-separated string of origins to allow CORS.
If allow_credential is set to true, you can forcefully allow CORS on all origins by configuring the field to ** but sensitive data, such as authentication tokens or cookies, can get exposed to any malicious website.
You can also configure allow origins on a global scale using the plugin metadata (opens in Apache APISIX docs), which configures the allow origins for all cors plugin instances. See the example for more details.
allow_methods — string · optional · default: * · since APISIX 1.2 · API7 Gateway 3.2.16.4
Comma-separated string of HTTP request methods to allow CORS.
If allow_credential is set to true, you can forcefully allow CORS on all methods by configuring the field to **, but a malicious actor can use HTTP methods, such as PUT or DELETE, to make unexpected modifications to shared resource and pose a security threat.
allow_headers — string · optional · default: * · since APISIX 1.2 · API7 Gateway 3.2.16.4
Comma-separated string of HTTP headers allowed in requests.
If allow_credential is set to true, you can forcefully allow CORS on all request headers by configuring the field to **, but it can potentially allow malicious headers to be sent to the server.
expose_headers — string · optional · since APISIX 1.2 · API7 Gateway 3.2.16.4
Comma-separated string of HTTP headers that should be made available in response to a cross-origin request.
max_age — integer · optional · default: 5 · since APISIX 1.2 · API7 Gateway 3.2.16.4
Maximum time in seconds for which the results of a preflight request can be cached. If the time is within this limit, the browser will check the cached result. To disable caching, set max_age to -1.
Note that the maximum value allowed is browser-dependent. See Access-Control-Max-Age for more details.
allow_credential — boolean · optional · default: false · since APISIX 1.2 · API7 Gateway 3.2.16.4
If true, allow requests to include credentials, such as cookies. According to CORS specification, when allow_credential is set to true, you cannot use * for other CORS attributes.
To allow all origins, set the field to **. This can potentially allow sensitive user data, such as authentication tokens or cookies, to be exposed to malicious actors.
allow_origins_by_regex — array[string] · optional · since APISIX 2.5 · API7 Gateway 3.2.16.4
RegEx to match origins that allow CORS. When configured, only domains in this range will be allowed and any configuration in allow_origins will be ignored.
For example, ['.*\\.test.com$'] can match all subdomains of test.com.
allow_origins_by_metadata — array[string] · optional · since APISIX 2.13.0 · API7 Gateway 3.2.16.4
Origins to enable CORS referenced from allow_origins set in the plugin metadata. For example, if allow_origins: {'EXAMPLE': 'https://example.com'} is set in the plugin metadata, then ['EXAMPLE'] can be used to allow CORS on the origin https://example.com.
timing_allow_origins — string · optional · since APISIX 3.8.0 · API7 Gateway 3.4.0
Comma-separated string of origins to allow to access the resource timing information. See Timing-Allow-Origin for more details.
timing_allow_origins_by_regex — array[string] · optional · since APISIX 3.8.0 · API7 Gateway 3.4.0
RegEx to match with origin for enabling access to the resource timing information. When configured, only domains matching the RegEx will be allowed and any configuration in timing_allow_origins will be ignored.
For example, ['.*\\.test.com'] can match all subdomain of test.com.
Plugin Metadata
allow_origins — object · optional · since APISIX 2.13.0 · API7 Gateway 3.2.16.4
A map of named origins to allow for CORS, where each key is an identifier referenced by allow_origins_by_metadata and each value is the corresponding origin string.
For example, {'EXAMPLE': 'https://example.com'} defines the key EXAMPLE for the origin https://example.com.
If allow_credential is set to true, you can forcefully allow CORS on all origins by setting a map value to **, but sensitive data, such as authentication tokens or cookies, can get exposed to any malicious website.