rest.ini [CorsSettings] #

The block [CorsSettings] of settings/rest.ini, with 7 setting(s).

Cross-origin resource sharing (CORS) for everything served by index_rest.php (/api/...: the content API, the
OAuth token end point and the routes of every REST provider). doc/eng-us/bc/6.0/rest-cors.md
Off by default: no CORS header is sent and an OPTIONS request is routed as before.

Never edit settings/rest.ini itself: an update replaces it. Put the settings you change in an override, which wins over the shipped file:

• settings/override/rest.ini.append.php for every siteaccess,
• settings/siteaccess/<siteaccess>/rest.ini.append.php for one siteaccess,
• extension/<extension>/settings/rest.ini.append.php in an extension (read when the extension is active).

Cors #

enabled or disabled (the default)

Default: disabled.

<?php /* #?ini charset="utf-8"?
# settings/override/rest.ini.append.php
[CorsSettings]
Cors=disabled
*/ ?>

AllowedOrigins #

The origins that may call the API from a browser, exactly as the browser sends them: scheme, host and port
(when not the default), no path and no trailing slash. A response to any other origin has no Access-Control-*
header. "null" is never accepted. "*" (any origin) is accepted only while AllowCredentials is disabled.

Default: an empty list.

<?php /* #?ini charset="utf-8"?
# settings/override/rest.ini.append.php
[CorsSettings]
# an empty "AllowedOrigins[]" first replaces the shipped list; without it the items are added
AllowedOrigins[]
*/ ?>

AllowedMethods #

AllowedOrigins[]=https://app.example.com
AllowedOrigins[]=http://localhost:3000
The methods a preflight may ask for

Default: a list of 5: GET, POST, PUT, PATCH, DELETE.

<?php /* #?ini charset="utf-8"?
# settings/override/rest.ini.append.php
[CorsSettings]
# an empty "AllowedMethods[]" first replaces the shipped list; without it the items are added
AllowedMethods[]
AllowedMethods[]=GET
AllowedMethods[]=POST
AllowedMethods[]=PUT
AllowedMethods[]=PATCH
AllowedMethods[]=DELETE
*/ ?>

AllowedHeaders #

The request headers a preflight may ask for (compared without case); a preflight that asks for any other is refused

Default: a list of 5: Authorization, Content-Type, Accept, Accept-Language, X-Siteaccess.

<?php /* #?ini charset="utf-8"?
# settings/override/rest.ini.append.php
[CorsSettings]
# an empty "AllowedHeaders[]" first replaces the shipped list; without it the items are added
AllowedHeaders[]
AllowedHeaders[]=Authorization
AllowedHeaders[]=Content-Type
AllowedHeaders[]=Accept
AllowedHeaders[]=Accept-Language
AllowedHeaders[]=X-Siteaccess
*/ ?>

ExposedHeaders #

Response headers a script of an allowed origin may read besides the CORS-safelisted ones

Default: an empty list.

<?php /* #?ini charset="utf-8"?
# settings/override/rest.ini.append.php
[CorsSettings]
# an empty "ExposedHeaders[]" first replaces the shipped list; without it the items are added
ExposedHeaders[]
*/ ?>

MaxAge #

How long a browser may keep the answer to a preflight, in seconds; 0 sends no Access-Control-Max-Age

Default: 600.

<?php /* #?ini charset="utf-8"?
# settings/override/rest.ini.append.php
[CorsSettings]
MaxAge=600
*/ ?>

AllowCredentials #

enabled or disabled (the default). Enabled: Access-Control-Allow-Credentials: true, so a browser sends and keeps
cookies on the cross-origin request (the session of a signed in user). Leave it disabled for clients that send an
OAuth token or an API key in the Authorization header, which is the usual case.

Default: disabled.

<?php /* #?ini charset="utf-8"?
# settings/override/rest.ini.append.php
[CorsSettings]
AllowCredentials=disabled
*/ ?>

Related #

• All blocks of rest.ini
• All INI files
• The settings page

Generated by ./console exp:help:examples from settings/rest.ini. Do not edit this page: change the source and generate again (how). Free documentation: GFDL 1.3 or later.