Magento 2 CORS

Magento Version Support

Ever try to work with the Magento GraphQL API or REST API from your browser and see the following?

Access to XMLHttpRequest at 'https://my.magento.app' from origin 'http://my.webapp.com' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource.

This package allows you to securely add the necessary CORS headers to the Magento 2 GraphQL or REST APIs with ease.

Purpose

When building a headless application for Magento, or working with a client that respects the CORS protocol, you will need CORS headers on your backend resource.

This package will add configurable CORS Resource headers to the Magento 2 GraphQL or REST APIs, allowing you to access the GraphQL or REST APIs from your browser.

Getting Started

This module is intended to be installed with composer. From the root of your Magento 2 project:

1. Download the package

composer require graycore/magento2-cors

1. Configure the package
2. Enable the package

./bin/magento module:enable Graycore_Cors

Features

• Configurable

• Respects the full CORS Protocol

  • Access-Control-Allow-Origin
  • Access-Control-Allow-Methods
  • Access-Control-Allow-Headers
  • Access-Control-Max-Age
  • Access-Control-Expose-Headers
  • Access-Control-Allow-Credentials

• Security By Default

• Vary: Origin

Helpful Links

• FAQ
  • Can I configure this from the admin panel?

Upgrading

• Semver Policy
• Guide

Changelog

All notable changes to this project will be documented in this file. See standard-version for commit guidelines.

2.1.3 (2026-05-18)

Miscellaneous Chores

• deps: bump googleapis/release-please-action from 4 to 5 (#96) (f402f78)
• deps: bump graycoreio/github-actions-magento2 (#98) (ec4e3c3)
• deps: bump graycoreio/github-actions-magento2 from 7.0.0 to 8.2.0 (#102) (0b872fa)
• deps: bump graycoreio/github-actions-magento2/.github/workflows/check-extension.yaml (#99) (77f4313)

2.1.2 (2026-02-27)

Miscellaneous Chores

• remove extraneous nodejs deps (0515bee)

2.1.1 (2025-04-15)

Bug Fixes

• prevent 500 errors on frontend/admin routes for options requests (627a211)

2.1.0 (2024-10-10)

Features

• docs: augment docs for configuring Commerce Cloud (#87) (d9f7f69)

2.0.1 (2024-02-07)

Bug Fixes

• Access-Control-Expose-Headers only set on preflight (#84) (f2515c8)
• wrong di.xml configuration - missing noNamespaceSchemaLocation and xmlns:xsi (#82) (104fd5d)

2.0.0 (2022-10-14)

Bug Fixes

• add compatability between Laminas\Http and Zend\Http (#75) (b1d4af1)

2.0.0-rc.0 (2022-06-11)

⚠ BREAKING CHANGES

• If you were expecting to use the native GraphQl/REST controller when computing CORS headers (and everything else that entails - like having a Magento session, for example) that guarantee is no-longer provided.

Features

• graphql,rest: add faster CORS headers (#66) (cefd663)

• denote breaking changes (b98b9bc)

1.6.0 (2022-06-11)

Features

• add Magento v2.4.4 and PHP8.1 support (#70) (6e8bfe1)
• rest: extend REST request to allow OPTIONS without error (#55) (eb1df2d)

1.4.1 (2021-03-04)

Bug Fixes

• graphql, rest: allow caching of options requests (#53) (f6b9b3f)

1.4.0 (2021-03-02)

Features

• graphql, rest: add support for access-control-expose-headers (#49) (53aac87)
• graphql, rest: apply certain headers only to preflight requests (#51) (30bcff0)
• graphql,rest: add support for Vary header with Origin (#47) (e656909)
• validator: add a new method to determine whether or not a reque… (#50) (8c3ef8b)

1.3.2 (2020-08-10)

1.3.1 (2020-08-10)

1.3.0 (2020-05-18)

Bug Fixes

• graphql: prevent fatal error when using Chrome extensions for graphql querying (#24) (486fe10)

Build System

• all: added unit tests to CI (#18) (aade441)
• all: adding linting with phpcs (#16) (8753bd2)
• all: set up CI with Azure Pipelines (#15) (f30b51f)
• ci: run integration tests in ci (#21) (a79d7f7)

Features

• cors: add header provider for Allow-Credentials (#27) (38bf597)

Tests

• configuration: added/updated unit tests for config files (#19) (826b68e)
• integration: updated integration tests to pass (#23) (89736d7)

1.2.0 (2020-01-20)

Features

• rest: fixup rest api to handle options requests (#13) (3520b9d)

1.1.0 (2020-01-17)

Bug Fixes

• graphql: swap config key name (#10) (2aed35c)

Features

• rest: add CORS support for Magento 2 REST APIs (#11) (2342976)
• rest: allow rest api and graphql apis to be configurable separately (#12) (ff5813e)

1.0.0 (2019-07-23)

Bug Fixes

• configuration: remove backtick in di.xml (3a6549c)

Features

• cors: initial package with configuration and validation for CORS headers on the GraphQL api (493c6ad)
• release: add basic release process (b09b62b)
• security: enforce security by default, no headers out of the box (cb3291c)

1.0.0 (2019-07-23)

Bug Fixes

• configuration: remove backtick in di.xml (3a6549c)

Features

• cors: initial package with configuration and validation for CORS headers on the GraphQL api (493c6ad)
• release: add basic release process (b09b62b)
• security: enforce security by default, no headers out of the box (cb3291c)