We provide several configuration keys for you to configure. The configurations between REST and GraphQL are split to accomodate the “Security by Default” mentality.
web/graphql/cors_allowed_origins - A comma separated list of the origins allowed to the access the GraphQL APIweb/graphql/cors_allowed_methods - A comma separated list of the allowed request methodsweb/graphql/cors_allowed_headers - A comma separated list of the allowed response headersweb/graphql/cors_max_age - The duration that the CORS policy should be cached for.web/graphql/cors_expose_headers - A comma separated list that indicates which headers can be exposed as part of the response.web/graphql/cors_allow_credentials - Whether to allow credentials on CORS requests
web/api_rest/cors_allowed_origins - A comma separated list of the origins allowed to the access the REST APIweb/api_rest/cors_allowed_methods - A comma separated list of the allowed request methodsweb/api_rest/cors_allowed_headers - A comma separated list of the allowed response headersweb/api_rest/cors_max_age - The duration that the CORS policy should be cached for.web/api_rest/cors_expose_headers - A comma separated list that indicates which headers can be exposed as part of the response.web/api_rest/cors_allow_credentials - Whether to allow credentials on CORS requestsYou can add the following to your app/etc/env.php to configure the package.
<?php
return [
...
'system' => [
'default' => [
'web' => [
'graphql' => [
'cors_allowed_origins' => 'https://www.graphql.com, https://www.myotherallowedorigin',
'cors_allowed_methods' => 'POST, OPTIONS',
'cors_allowed_headers' => '',
'cors_max_age' => '86400',
'cors_allow_credentials' => 1
],
'api_rest' => [
'cors_allowed_origins' => 'https://www.restapi.com, https://www.myotherallowedorigin',
'cors_allowed_methods' => 'GET, POST, OPTIONS',
'cors_allowed_headers' => '',
'cors_max_age' => '86400',
'cors_allow_credentials' => 0
]
]
]
]
...
];
You can also optionally set the
cors_allowed_originskey to*if you want to allow ALL origins access to the resource, but we strongly suggest you understand the ramifications of this before doing so. Note also that the CORS specification disallows a wildcard for Allowed Origins if thecors_allow_credentialsflag is enabled. If this is the case, the server will instead echo the request Origin back as the Allow-Origin value.