CORS mechanism
Concept Description
Cross-Origin Resource Sharing (CORS) allows Web servers to perform cross-domain access, enabling browsers to more securely transfer data across domains.
Scenario
When the user needs to send REST requests across the origin webserver, the CORS mechanism may be used. The microservices that receive cross-domain requests need to enable CORS support.
Configuration instructions
The CORS function is configured in the microservice.yaml file. The configuration items are described in the following table.
| Configuration Item | Default Value | Range of Value | Required | Meaning | |
|---|---|---|---|---|---|
| servicecomb.cors.enabled | false |
true/false |
No | Whether to enable CORS function | - |
| servicecomb.cors.origin | * |
- | No | Access-Control-Allow-Origin | - |
| servicecomb.cors.allowCredentials | false |
true/false |
No | Access-Control-Allow-Credentials | According to the CORS standard, when Access-Control-Allow-Credentials is set to true, Access- Control-Allow-Origin cannot be set to "*", otherwise an exception will be thrown |
| servicecomb.cors.allowedHeader | None | - | No | Access-Control-Allow-Headers | Multiple values separated by commas |
| servicecomb.cors.allowedMethod | None | - | No | Access-Control-Allow-Methods | Multiple values separated by commas |
| servicecomb.cors.exposedHeader | None | - | No | Access-Control-Expose-Headers | Multiple values separated by commas |
| servicecomb.cors.maxAge | None | (0,2147483647], Integer | No | Access-Control-Max-Age | The unit is seconds. If the user does not configure this, there is no Access-Control-Max in the CORS response. Age |
Sample Code
servicecomb:
cors:
enabled: true
origin: "*"
allowCredentials: false
allowedMethod: PUT,DELETE
maxAge: 3600