API Gateway:Configure a CORS policy

Procedure

1. You can configure a CORS policy from either inside or outside an instance:

   APIs outside an instance

   1. Log on to the Cloud-native API Gateway console. In the left-side navigation pane, choose API, and then select a region.

   2. Click the target API. From the instance drop-down list, select the target instance or All instances.

   3. Select the target route from the Routes list.

   APIs inside an instance

   1. Log on to the Cloud-native API Gateway console. In the left-side navigation pane, choose Instance, and then select a region.

   2. On the Instance page, click the target instance. In the left-side navigation pane, choose API and click the target API.

   3. Select the target route from the Routes list.

2. Click the Configure Policy tab, and then click Enable Policy/Plug-in in the Inbound Processing section.

3. Click the CORS card. In the Add Policy: CORS panel, configure the parameters and then click Add.

   Note

   CORS policies do not apply to mock services. Use a real backend service for testing.

   Parameter	Description
   Enable	Turn on the Enable switch. Enabled: Specified third-party origins can access your server resources through a browser. Disabled: No third-party origins can access your server resources through a browser.
   Allowed Origins	The origins allowed to access your server resources. Supported formats: All origins: *. Wildcard subdomain match: *.example.com. Multiple specific origins: enter each origin on a separate line, starting with http:// or https://. Note Maps to the Access-Control-Allow-Origin header. When a request's Origin matches an allowed origin, the response Access-Control-Allow-Origin header returns that Origin value.
   Allowed Methods	The HTTP methods allowed for cross-origin requests. Common methods: GET, POST, PUT, DELETE, HEAD, OPTIONS, and PATCH. Note Maps to the Access-Control-Allow-Methods header.
   Allowed Request Headers	Non-standard request headers allowed in cross-origin requests. All headers: *. Multiple specific headers: enter each name on a separate line. Note Maps to the Access-Control-Allow-Headers header.
   Allowed Response Headers	Response headers exposed to client-side scripts. All headers: *. Multiple specific headers: enter each name on a separate line. Note Maps to the Access-Control-Expose-Headers header.
   Allow to Carry Credentials	Whether cross-origin requests can include credentials such as cookies and HTTP authentication. Note Maps to the Access-Control-Allow-Credentials header.
   Precheck Expiration Time	The duration in seconds that a browser can cache preflight (OPTIONS) response results for non-simple requests. Note Maps to the Access-Control-Max-Age header.

Verification

• Send a test request:

  curl -I -H "Origin: http://example.com" -H "Access-Control-Request-Method: GET" -H 'Host: www.test.com' -X OPTIONS http://121.196.XX.XX/demo/item/list 

• Expected output:

  HTTP/1.1 200 OK
  allow: GET,HEAD,OPTIONS
  x-content-type-options: nosniff
  x-xss-protection: 1; mode=block
  cache-control: no-cache, no-store, max-age=0, must-revalidate
  pragma: no-cache
  expires: 0
  x-frame-options: DENY
  content-length: 0
  date: Tue, 30 Nov 2021 03:20:31 GMT
  x-envoy-upstream-service-time: 6
  access-control-allow-origin: http://example.com
  access-control-allow-credentials: true
  access-control-allow-methods: GET,POST,PUT,DELETE,HEAD,OPTIONS
  access-control-expose-headers: *
  server: istio-envoy