Parameters
See plugin common configurations for configuration options available to all plugins.
allow_origins
string
default:
*Comma-separated string of origins to allow CORS.
If
allow_credentialis set totrue, you can forcefully allow CORS on all origins by configuring the field to**but sensitive data, such as authentication tokens or cookies, can get exposed to any malicious website.You can also configure allow origins on a global scale using the plugin metadata, which configures the allow origins for all
corsplugin instances. See the example for more details.allow_methods
string
default:
*Comma-separated string of HTTP request methods to allow CORS.
If
allow_credentialis set totrue, you can forcefully allow CORS on all methods by configuring the field to**, but a malicious actor can use HTTP methods, such asPUTorDELETE, to make unexpected modifications to shared resource and pose a security threat.allow_headers
string
default:
*Comma-separated string of HTTP headers allowed in requests.
If
allow_credentialis set totrue, you can forcefully allow CORS on all request headers by configuring the field to**, but it can potentially allow malicious headers to be sent to the server.expose_headers
string
default:
*Comma-separated string of HTTP headers that should be made available in response to a cross-origin request.
If
allow_credentialis set totrue, you can forcefully allow CORS on all response headers by configuring the field to**.max_age
integer
default:
5Maximum time in seconds for which the results of a preflight request can be cached. If the time is within this limit, the browser will check the cached result. To disable caching, set
max_ageto-1.Note that the maximum value allowed is browser-dependent. See
Access-Control-Max-Agefor more details.allow_credential
boolean
default:
falseIf true, allow requests to include credentials, such as cookies. According to CORS specification, when
allow_credentialsis set to true, you cannot use*for other CORS attributes.To allow all origins, set the field to
**. This can potentially allow sensitive user data, such as authentication tokens or cookies, to be exposed to malicious actors.allow_origins_by_regex
array[string]
RegEx to match origins that allow CORS. When configured, only domains in this range will be allowed and any configuration in
allow_originswill be ignored.For example,
['.*\.test.com$']can match all subdomains oftest.com.allow_origins_by_metadata
array[string]
Origins to enable CORS referenced from
allow_originsset in the plugin metadata. For example, ifallow_origins: {'EXAMPLE': 'https://example.com'}is set in the plugin metadata, then['EXAMPLE']can be used to allow CORS on the originhttps://example.com.timing_allow_origins
string
Comma-separated string of origins to allow to access the resource timing information. See
Timing-Allow-Originfor more details.timing_allow_origins_by_regex
array[string]
RegEx to match with origin for enabling access to the resource timing information. When configured, only domains matching the RegEx will be allowed and any configuration in
timing_allow_originswill be ignored.For example,
['.*\.test.com']can match all subdomain oftest.com.
Plugin Metadata
allow_origins
string
default:
*Comma-separated string of origins to allow CORS.
If
allow_credentialis set totrue, you can forcefully allow CORS on all origins by configuring the field to**but sensitive data, such as authentication tokens or cookies, can get exposed to any malicious website.