– GraphQL Conductor

CORS

The cors plugin enables Cross-Origin Resource Sharing (CORS) configuration for your GraphQL API.

By using this plugin, you can define rules for allowing cross-origin requests to your GraphQL server. This is essential for web applications that need to interact with your API from different domains.

Configuration

Examples

This example demonstrates how to configure the CORS plugin with a strict list of methods, headers and origins.

YAML

type: "cors"
enabled: true
config:
  max_age: 3600
  allow_credentials: true
  allowed_methods: "GET, POST"
  allowed_origin: "https://example.com"
  allowed_headers: "Content-Type, Authorization"
  allow_private_network: false

JSON

{
  "type": "cors",
  "enabled": true,
  "config": {
    "max_age": 3600,
    "allow_credentials": true,
    "allowed_methods": "GET, POST",
    "allowed_origin": "https://example.com",
    "allowed_headers": "Content-Type, Authorization",
    "allow_private_network": false
  }
}

Reference

allow_credentials

boolean

optional

default: false

Access-Control-Allow-Credentials: Specifies whether to include credentials in the CORS headers. Credentials can include cookies, authorization headers, or TLS client certificates. Indicates whether the response to the request can be exposed when the credentials flag is true.

allow_private_network

boolean

optional

default: false

Access-Control-Allow-Private-Network: Indicates whether requests from private networks are allowed when originating from public networks.

allowed_headers

string

optional

default: "*"

Access-Control-Allow-Headers: Lists the headers allowed in actual requests. This helps in specifying which headers can be used when making the actual request. Used in response to a preflight request to indicate which HTTP headers can be used when making the actual request. You can also specify a special value "*" to allow any headers to be used when making the actual request, and the Access-Control-Request-Headers will be used from the incoming request.

allowed_methods

string

optional

default: "*"

Access-Control-Allow-Methods: Defines the HTTP methods allowed when accessing the resource. This is used in response to a CORS preflight request. Specifies the method or methods allowed when accessing the resource in response to a preflight request. You can also specify a special value "*" to allow any HTTP method to access the resource.

allowed_origin

string

optional

default: "*"

Access-Control-Allow-Origin: Determines which origins are allowed to access the resource. It can be a specific origin or a wildcard for allowing any origin. You can also specify a special value "*" to allow any origin to access the resource. You can also specify a special value "reflect" to allow the origin of the incoming request to access the resource.

exposed_headers

string

optional

default: "*"

Access-Control-Expose-Headers: The "Access-Control-Expose-Headers" response header allows a server to indicate which response headers should be made available to scripts running in the browser, in response to a cross-origin request. You can also specify a special value "*" to allow any headers to be exposed to scripts running in the browser.

max_age

integer

optional

Access-Control-Max-Age: Indicates how long the results of a preflight request can be cached. This field represents the duration in seconds.

VRL (Custom Plugins)JWT Authentication