CORS settings

These settings used to control CORS options.

CORSSettings

CORS Middleware Settings.

See CORSMiddleware documentation.

Note

You can pass here any extra option supported by CORSMiddleware, even if it is not mentioned in documentation.

Examples:

For development environment:

config.yml

server:
  cors:
    enabled: true
    allow_origins: ['*']
    allow_methods: ['*']
    allow_headers: ['*']
    expose_headers: [X-Request-ID, Location, Access-Control-Allow-Credentials]

For production environment:

config.yml

server:
  cors:
    enabled: true
    allow_origins: [production.example.com]
    allow_methods: [GET]
    allow_headers: [X-Request-ID, X-Request-With]
    expose_headers: [X-Request-ID]
    # custom option passed directly to middleware
    max_age: 600

Parameters:

• enabled

  (bool, default: True ) –

  Set to True to enable middleware

• allow_origins

  (list[str], default: <dynamic> ) –

  Domains allowed for CORS

• allow_credentials

  (bool, default: False ) –

  If True, cookies should be supported for cross-origin request

• allow_methods

  (list[str], default: ['GET'] ) –

  HTTP Methods allowed for CORS

• allow_headers

  (list[str], default: ['X-Request-ID', 'X-Request-With'] ) –

  HTTP headers allowed for CORS

• expose_headers

  (list[str], default: ['X-Request-ID'] ) –

  HTTP headers exposed from backend