Configuring CORS

Constraints

• An API can be bound to only one plug-in policy of the same type in the same environment. A plug-in policy that has been bound to an API cannot be deleted.
• In the same API group, all APIs published in the same environment and with the same request path can be bound only to the same CORS policy.
• If you have enabled CORS for an API and have also bound a CORS policy to the API, the policy will be used.
• If a request path contains an API with the OPTIONS method, none of the APIs in the request path can be bound to the CORS policy in the environment where the API is published.
• When you bind a plug-in policy to an API, ensure that the request method of the API is specified in allow_methods.

Creating a CORS Policy

1. Log in to the ROMA Connect console. On the Instances page, click View Console next to a specific instance.
2. In the navigation pane on the left, choose API Connect > API Policies. On the Policies tab, click Create Policy.
3. On the Select Policy Type page, select CORS in the Plug-ins area.
4. On the page displayed, configure plug-in policy information.

   Table 1 Policy configuration

   Parameter	Description
   Name	Enter a policy name. Using naming rules facilitates future search.
   Type	Fixed as CORS.
   Scope	Specify the scope to view the policy. Integration application: Each policy belongs to an integration application. Only users who have the permission on the integration application can view and use the policy. All: All users in the current instance can view and use the policy.
   Integration Application	Mandatory for Scope set to Integration application. Select an integration application for the policy. If none is available, click Create Integration Application on the right to create one.
   Description	Describe the policy.
   Policy Content: Configure the policy in a form or script. For details about how to configure a script, see Script Configuration Example.
   Allowed Origins	Access-Control-Allow-Origin response header, which specifies the external domain URIs that are allowed to access the API. Use commas (,) to separate multiple URIs. For requests that do not carry identity credentials, set this parameter to * to allow access requests from all domains.
   Allowed Methods	The Access-Control-Allow-Methods header specifies the HTTP methods that can be used in a request.
   Allowed Headers	Access-Control-Allow-Headers response header, which specifies request headers that can be used when sending XMLHttpRequest requests. Use commas (,) to separate multiple headers. By default, simple request headers Accept, Accept-Language, Content-Language, and Content-Type (only if the value is application/x-www-form-urlencoded, multipart/form-data, or text/plain) are carried in requests. You do not need to configure these headers in this parameter.
   Exposed Headers	Access-Control-Expose-Headers response header, which specifies which response headers can be contained in the response of XMLHttpRequest. Use commas (,) to separate multiple headers. By default, basic response headers Cache-Control, Content-Language, Content-Type, Expires, Last-Modified, and Pragma can be contained in the response. You do not need to configure these headers in this parameter.
   Maximum Age	Access-Control-Max-Age response header, which specifies the validity period (in seconds) of the preflight request. No more preflight requests are needed within the period.
   Allow Credentials	The Access-Control-Allow-Credentials header indicates whether the response to the request can be exposed to browsers.

5. Click OK.

   After a plug-in policy is created, perform Binding a Plug-in Policy to an API for the policy to take effect for the API.

Binding a Plug-in Policy to an API

1. On the Policies tab, filter policies by CORS.
2. Click the name of a policy to go to the details page.
3. On the APIs tab, select the environment of the APIs you want to bind the policy to and click Bind to APIs.
4. On the page displayed, select the APIs to bind the policy to.

   APIs can be filtered by API group and API name.

5. Click OK.

Script Configuration Example

{
  "allow_origin": "*",
  "allow_methods": "GET,POST,PUT",
  "allow_headers": "Accept-Ranges,Cache-Control",
  "expose_headers": "X-Request-Id,X-Apig-Latency",
  "max_age": 172800,
  "allow_credentials": true
}