Magento 2 CORS

Magento Version Support

Ever try to work with the Magento GraphQL API or REST API from your browser and see the following?

Access to XMLHttpRequest at 'https://my.magento.app' from origin 'http://my.webapp.com' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource.

This package allows you to securely add the necessary CORS headers to the Magento 2 GraphQL or REST APIs with ease.

Purpose

When building a headless application for Magento, or working with a client that respects the CORS protocol, you will need CORS headers on your backend resource.

This package will add configurable CORS Resource headers to the Magento 2 GraphQL or REST APIs, allowing you to access the GraphQL or REST APIs from your browser.

Getting Started

This module is intended to be installed with composer. From the root of your Magento 2 project:

1. Download the package

composer require graycore/magento2-cors

1. Configure the package
2. Enable the package

./bin/magento module:enable Graycore_Cors

Features

• Configurable

• Respects the full CORS Protocol

  • Access-Control-Allow-Origin
  • Access-Control-Allow-Methods
  • Access-Control-Allow-Headers
  • Access-Control-Max-Age
  • Access-Control-Expose-Headers
  • Access-Control-Allow-Credentials

• Security By Default

• Vary: Origin

Helpful Links

• FAQ
  • Can I configure this from the admin panel?

Upgrading

• Semver Policy
• Guide

Changelog

All notable changes to this project will be documented in this file. See standard-version for commit guidelines.

1.4.1 (2021-03-04)

Bug Fixes

• graphql, rest: allow caching of options requests (#53) (f6b9b3f)

1.4.0 (2021-03-02)

Features

• graphql, rest: add support for access-control-expose-headers (#49) (53aac87)
• graphql, rest: apply certain headers only to preflight requests (#51) (30bcff0)
• graphql,rest: add support for Vary header with Origin (#47) (e656909)
• validator: add a new method to determine whether or not a reque… (#50) (8c3ef8b)

1.3.2 (2020-08-10)

1.3.1 (2020-08-10)

1.3.0 (2020-05-18)

Bug Fixes

• graphql: prevent fatal error when using Chrome extensions for graphql querying (#24) (486fe10)

Build System

• all: added unit tests to CI (#18) (aade441)
• all: adding linting with phpcs (#16) (8753bd2)
• all: set up CI with Azure Pipelines (#15) (f30b51f)
• ci: run integration tests in ci (#21) (a79d7f7)

Features

• cors: add header provider for Allow-Credentials (#27) (38bf597)

Tests

• configuration: added/updated unit tests for config files (#19) (826b68e)
• integration: updated integration tests to pass (#23) (89736d7)

1.2.0 (2020-01-20)

Features

• rest: fixup rest api to handle options requests (#13) (3520b9d)

1.1.0 (2020-01-17)

Bug Fixes

• graphql: swap config key name (#10) (2aed35c)

Features

• rest: add CORS support for Magento 2 REST APIs (#11) (2342976)
• rest: allow rest api and graphql apis to be configurable separately (#12) (ff5813e)

1.0.0 (2019-07-23)

Bug Fixes

• configuration: remove backtick in di.xml (3a6549c)

Features

• cors: initial package with configuration and validation for CORS headers on the GraphQL api (493c6ad)
• release: add basic release process (b09b62b)
• security: enforce security by default, no headers out of the box (cb3291c)

1.0.0 (2019-07-23)

Bug Fixes

• configuration: remove backtick in di.xml (3a6549c)

Features

• cors: initial package with configuration and validation for CORS headers on the GraphQL api (493c6ad)
• release: add basic release process (b09b62b)
• security: enforce security by default, no headers out of the box (cb3291c)