DocsEdge StackCross-Origin Resource Sharing (CORS)
Cross-Origin Resource Sharing (CORS)
Cross-Origin resource sharing lets users request resources (e.g., images, fonts, videos) from domains outside the original domain.
CORS configuration can be set for all Ambassador Edge Stack mappings in the ambassador Module
, or set per Mapping
.
When the CORS attribute is set at either the Mapping
or Module
level, Ambassador Edge Stack will intercept the pre-flight OPTIONS
request and respond with the appropriate CORS headers. This means you will not need to implement any logic in your upstreams to handle these CORS OPTIONS
requests.
The flow of the request will look similar to the following:
The cors
attribute
The cors
attribute enables the CORS filter. The following settings are supported:
origins
: Specifies a list of allowed domains for theAccess-Control-Allow-Origin
header. To allow all origins, use the wildcard"*"
value. Format can be either of:- comma-separated list, e.g.
- YAML array, e.g.
methods
: if present, specifies a list of allowed methods for theAccess-Control-Allow-Methods
header. Format can be either of:- comma-separated list, e.g.
- YAML array, e.g.
headers
: if present, specifies a list of allowed headers for theAccess-Control-Allow-Headers
header. Format can be either of:- comma-separated list, e.g.
- YAML array, e.g.
credentials
: if present with a true value (boolean), will send atrue
value for theAccess-Control-Allow-Credentials
header.exposed_headers
: if present, specifies a list of allowed headers for theAccess-Control-Expose-Headers
header. Format can be either of:- comma-separated list, e.g.
- YAML array, e.g.
max_age
: if present, indicated how long the results of the preflight request can be cached, in seconds. This value must be a string.
Example
AuthService and Cross-Origin Resource Sharing
When you use external authorization, each incoming request is authenticated before routing to its destination, including pre-flight OPTIONS
requests.
By default, many AuthService
implementations will deny these requests. If this is the case, you will need to add some logic to your AuthService
to accept all CORS headers.
For example, a possible configuration for Spring Boot 2.0.1:
This is okay since CORS is being handled by Ambassador Edge Stack after authentication.
The flow of this request will look similar to the following: