[CorsSettings]
Available since Exponential 6.0.15 (in development, not in a release yet).
Summary
Cross-origin resource sharing (CORS) for everything served by index_rest.php (/api/...: the content API, the OAuth token end point and the routes of every REST provider). doc/eng-us/bc/6.0/rest-cors.md Off by default: no CORS header is sent and an OPTIONS request is routed as before.
File
settings/rest.ini; override it in settings/override/rest.ini.append.php, in a siteaccess or in an extension.
Settings
| Setting | Default | Description |
|---|---|---|
| Cors | disabled | enabled or disabled (the default) |
| AllowedOrigins[] | (empty array) | The origins that may call the API from a browser, exactly as the browser sends them: scheme, host and port (when not the default), no path and no trailing slash. A response to any other origin has no Access-Control-* header. "null" is never accepted. "*" (any origin) is accepted only while AllowCredentials is disabled. |
| AllowedMethods[] | GET; POST; PUT; PATCH; DELETE | AllowedOrigins[]=https://app.example.com AllowedOrigins[]=http://localhost:3000 The methods a preflight may ask for |
| AllowedHeaders[] | Authorization; Content-Type; Accept; Accept-Language; X-Siteaccess | The request headers a preflight may ask for (compared without case); a preflight that asks for any other is refused |
| ExposedHeaders[] | (empty array) | Response headers a script of an allowed origin may read besides the CORS-safelisted ones |
| MaxAge | 600 | How long a browser may keep the answer to a preflight, in seconds; 0 sends no Access-Control-Max-Age |
| AllowCredentials | disabled | enabled or disabled (the default). Enabled: Access-Control-Allow-Credentials: true, so a browser sends and keeps cookies on the cross-origin request (the session of a signed in user). Leave it disabled for clients that send an OAuth token or an API key in the Authorization header, which is the usual case. |
See also
Generated example: rest.ini [CorsSettings]
Added to the reference for Exponential 6.0.15: the 4.x reference had no page for this group. The descriptions are the comment lines of settings/rest.ini.
Contributors
- Graham Brookins Updated
Comments
Add a comment