Enable CORS
The CORS plugin allows users to enable the Cross-Origin Resource Sharing mechanism on API7 Cloud.
You can configure the CORS plugin in a service or a route.
- If you configure the CORS plugin only for a service, it'll affect all routes in it.
- If you configure the CORS plugin only for route, then the CORS plugin only affects this route.
- If you configure the CORS plugin for both the service and the route, the CORS plugin in route takes precedence.
How to Configure CORS Plugin
You can configure the CORS plugin when creating or updating a service or route.
In the above image, you can see:
Access-Control-Allow-Originis set tohttp://127.0.0.1:9080.Access-Control-Allow-Methodsis set toGET.Access-Control-Max-Ageis set to5(seconds).Access-Control-Allow-Credentialsisfalse.Access-Control-Allow-HeadersandAccess-Control-Expose-Headersare set to*.
How to Test the CORS Plugin
First, deploy a gateway instance and connect to the API7 Cloud. Please see Add a gateway instance and connect it to the API7 Cloud to learn the details.
Then we can send a request to verify the CORS plugin.
curl http://127.0.0.1:9080/v1/json -H 'Host: cloud.httpbin.org' -H 'Origin: http://127.0.0.1:9080' -X OPTIONS -i
HTTP/1.1 200 OK
Date: Wed, 13 Apr 2022 07:07:53 GMT
Content-Type: text/plain; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Server: APISIX/2.15.0
Access-Control-Allow-Origin: http://127.0.0.1:9080
Vary: Origin
Access-Control-Allow-Methods: GET
Access-Control-Max-Age: 5
Access-Control-Expose-Headers: *
Access-Control-Allow-Headers: *
As you can see, the CORS headers are the same as the ones in the above image that we set.
the CORS plugin overrides the CORS headers from upstream. But the
Access-Control-Allow-Credentials header is special. The CORS plugin doesn't
set this header if the value is false. So in such a case, if you still see
the Access-Control-Allow-Credentials header in the response, it means that
it's your upstream set it.