Cross-Origin Resource Sharing (CORS)

Cross-Origin resource sharing lets users request resources (e.g., images, fonts, videos) from domains outside the original domain.

CORS configuration can be set for all Ambassador Edge Stack mappings in the ambassador Module, or set per Mapping.

When the CORS attribute is set at either the Mapping or Module level, Ambassador Edge Stack will intercept the pre-flight OPTIONS request and respond with the appropriate CORS headers. This means you will not need to implement any logic in your upstreams to handle these CORS OPTIONS requests.

The flow of the request will look similar to the following:

The cors attribute

The cors attribute enables the CORS filter. The following settings are supported:

• origins: Specifies a list of allowed domains for the Access-Control-Allow-Origin header. To allow all origins, use the wildcard "*" value. Format can be either of:

  • comma-separated list, e.g.
  • YAML array, e.g.

• methods: if present, specifies a list of allowed methods for the Access-Control-Allow-Methods header. Format can be either of:

  • comma-separated list, e.g.
  • YAML array, e.g.

• headers: if present, specifies a list of allowed headers for the Access-Control-Allow-Headers header. Format can be either of:

  • comma-separated list, e.g.
  • YAML array, e.g.

• credentials: if present with a true value (boolean), will send a true value for the Access-Control-Allow-Credentials header.

• exposed_headers: if present, specifies a list of allowed headers for the Access-Control-Expose-Headers header. Format can be either of:

  • comma-separated list, e.g.
  • YAML array, e.g.

• max_age: if present, indicated how long the results of the preflight request can be cached, in seconds. This value must be a string.

Example

AuthService and Cross-Origin Resource Sharing

When you use external authorization, each incoming request is authenticated before routing to its destination, including pre-flight OPTIONS requests.

By default, many AuthService implementations will deny these requests. If this is the case, you will need to add some logic to your AuthService to accept all CORS headers.

For example, a possible configuration for Spring Boot 2.0.1:

This is okay since CORS is being handled by Ambassador Edge Stack after authentication.

The flow of this request will look similar to the following: