Enabling CORS for APIs¶
Cross-Origin Resource Sharing (CORS) is a mechanism that allows accessing restricted resources (i.e., fonts, images, scripts, videos and iframes) from domains outside the domain from which the requesting resource originated. By default, web browsers apply the same-origin policy to avoid interactions between different origins. CORS defines a way in which a browser and a server can interact to determine whether or not it is safe to allow the cross-origin requests.
In API Manager, you can enable Cross-Origin Resource Sharing per API or as a global configuration that is applied across all APIs.
Enabling CORS Globally¶
You can enable CORS globally for API Manager by configuring deployment.toml located in
Follow the steps below to enable CORS response headers globally. Once this configuration is enabled, it will be applied across all the APIs served by the API Gateway.
- Open the
Locate the following configuration and set the
truewith the required CORS headers in the response. Once this configuration is applied in the API Gateway, it will affect all the API calls served by the Gateway.
[apim.cors] enable = true allow_origins = "*" allow_methods = ["GET","PUT","POST","DELETE","PATCH","OPTIONS"] allow_headers = ["authorization","Access-Control-Allow-Origin","Content-Type","SOAPAction"] allow_credentials = false
CORS configuration is enabled by default. Access control can be done by changing the parameters mentioned above in the
Enabling CORS Per API¶
It is required to enable CORS globally before you enable CORS Per API. Therefore if you haven't done it yet, follow the steps in Enabling CORS Globally before starting the below steps.
Sign in to API Publisher and create a new API. Go to the Runtime Configurations tab.
Enable the switch under CORS Configuration to enable CORS for the API.
Once you enable CORS, you will be able to see the CORS response header configuration section. Listed below are the CORS specific response headers supported by the API Gateway and how to configure them.
Header Description Sample values Access-Control-Allow-Origin Determines whether a resource can be shared with the resource of a given origin. The API Gateway validates the origin request header value against the list of origins defined under the Access Control Allow Origins configuration(this can be
All Allow Originsor a specific value like
localhost). If the host is in the allowed origin list, it will be set as the Access-Control-Allow-Origin response header in the response.
All Allow Origins(*), localhost Access-Control-Allow-Headers Determines, as part of the response to a preflight request (a request that checks to see if the CORS protocol is understood), which header field names can be used during the actual request. The gateway will set the header values defined under Access Control Allow Headers configurations. authorization, Access-Control-Allow-Origin, Content-type, SOAPAction Access-Control-Allow-Methods This header specifies the method(s) allowed when accessing the resource in response to a preflight request. Required methods can be defined under the Access Control Allow Method configuration. GET, PUT, POST, DELETE, PATCH, OPTIONS Access-Control-Allow-Credentials Determines whether or not the response to the request can be exposed to the page. It can be exposed when the header value is true. The header value can be set to true/false by enabling/disabling the Access Control Allow Credentials configuration. true, false
Once the CORS configurations are done, click Save.
You have successfully enabled CORS for a specific API.
Enabling CORS for OAuth Token related APIs¶
Enabling CORS configuration through
api-manager.xml is only valid for APIs created through the API manager Publisher application. Hence, enabling CORS for OAuth token related APIs ( /authorize, /revoke, /token, /userinfo ) can be carried out as follows.
Based on the API that you need to enable CORS, add the following handler configuration to the relevant API synapse file present in
<API-M_HOME>/repository/deployment/server/synapse-configs/default/api/ folder. It should be added within the
<handlers> parent element.
<handler class="org.wso2.carbon.apimgt.gateway.handlers.security.CORSRequestHandler"> <property name="apiImplementationType" value="ENDPOINT"/> </handler>
The following are the mappings of the synapse files corresponding to the OAuth token related APIs.