Skip to main content

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

Required fields*

9
  • 8
    Why specify allowedOrigins and then also pass '*' ? Commented Jun 20, 2018 at 2:05
  • Simply to show both options. Please feel free to omit one or the other. Commented Jun 21, 2018 at 15:02
  • exposedHeaders should be false or an array, per drupal.org/project/drupal/issues/2905848 Commented Jul 12, 2019 at 14:50
  • If anyone's interested, I don't believe that the allowedOrigins field accepts regex. I tried a use a regex pattern to whitelist multiple sub-domains, and drupal complained. I had to use an explicit list of domains, comma-separated, like in this example. I was hoping it would behave like the trusted-hosts setting in settings.php Commented Sep 9, 2019 at 14:51
  • @TonyStecca: asm89/stack-cors accepts regex patterns since version 1.2.0, via the allowedOriginsPatterns config parameter. For anybody wanting to help make the 'new' parameter easy to discover, some feedback for drupal.org/project/drupal/issues/3205688 would be appreciated. Commented Mar 25, 2021 at 18:29