Configuration

Allow headers that match predicate

Allow headers prefixed with headerPrefix

Allow to send X-Http-Method-Override header

Allow requests from any host

Allow to expose header. It adds the header to Access-Control-Expose-Headers if it is not a simple response header.

Allow to expose X-Http-Method-Override header

Allow sending header

Allow requests from the specified domains and schemes. A wildcard is supported for either the host or any subdomain. If you specify a wildcard in the host, you cannot add specific subdomains. Otherwise you can mix wildcard and non-wildcard subdomains as long as the wildcard is always in front of the domain, e.g. *.sub.domain.com but not sub.*.domain.com.

Please note that CORS operates ONLY with REAL HTTP methods and will never consider overridden methods via X-Http-Method-Override. However you can add them here if you are implementing CORS at client side from the scratch that you generally don't need to do.

Allow sending credentials

Allow sending requests with non-simple content-types. The following content types are considered simple:

Allow requests from the same origin

Exposed HTTP headers that could be accessed by a client

If present represents the prefix for headers which are permitted in cors requests.

Allowed CORS headers

Allowed CORS hosts

Max-Age for cached CORS options

Duration in seconds to tell the client to keep the host in a list of known HSTS hosts.

Allowed HTTP methods

Duration to tell the client to keep CORS options.