--- title: CORS Support description: Enable and configure CORS headers in MockServer for control-plane and mocked responses, with examples for permissive and restrictive policies. layout: page pageOrder: 9 section: 'General' subsection: true sitemap: priority: 0.7 changefreq: 'monthly' lastmod: 2019-11-10T08:00:00+01:00 ---

MockServer and the proxy has support for CORS. By default, CORS support is not enabled for the Control Plane API and or for mocked response, such as, when expectations are matched, or proxied requests.

When CORS support is enabled the following headers are be added by default:

    Access-Control-Allow-Origin: ""
    Access-Control-Allow-Methods: ""
    Access-Control-Allow-Headers: ""
    Access-Control-Expose-Headers: ""
    Access-Control-Allow-Credentials: "false"
    Access-Control-Max-Age: "0"

NOTE: the default configuration will prevent all cross-site requests

To avoid security risk from cross-site requests CORS headers should be configured to the minimum required values for your use case, using the CORS configuration properties, as below.

A more permission approach that enables most use cases would configure the CORS headers, as follows:

    Access-Control-Allow-Origin: "*"
    Access-Control-Allow-Methods: "CONNECT, DELETE, GET, HEAD, OPTIONS, POST, PUT, PATCH, TRACE"
    Access-Control-Allow-Headers: "Allow, Content-Encoding, Content-Length, Content-Type, ETag, Expires, Last-Modified, Location, Server, Vary, Authorization"
    Access-Control-Expose-Headers: "Allow, Content-Encoding, Content-Length, Content-Type, ETag, Expires, Last-Modified, Location, Server, Vary, Authorization"
    Access-Control-Max-Age: "300"

For example to enable a more permission approach for cross-site requests use ConfigurationProperties class as follows:

    ConfigurationProperties.enableCORSForAllResponses(true);
    ConfigurationProperties.corsAllowOrigin("*");
    ConfigurationProperties.corsAllowMethods("CONNECT, DELETE, GET, HEAD, OPTIONS, POST, PUT, PATCH, TRACE");
    ConfigurationProperties.corsAllowHeaders("Allow, Content-Encoding, Content-Length, Content-Type, ETag, Expires, Last-Modified, Location, Server, Vary, Authorization");
    ConfigurationProperties.corsMaxAgeInSeconds(300);

{% include_subpage _includes/cors_configuration.html %}

## Examples:

    ConfigurationProperties.enableCORSForAllResponses(true);
    ConfigurationProperties.corsAllowMethods("CONNECT, DELETE, GET, HEAD, OPTIONS, POST, PUT, PATCH, TRACE");
    ConfigurationProperties.corsAllowHeaders("Allow, Content-Encoding, Content-Length, Content-Type, ETag, Expires, Last-Modified, Location, Server, Vary, Authorization");
    ConfigurationProperties.corsAllowCredentials(true);
    ConfigurationProperties.corsMaxAgeInSeconds(300);

    java -Dmockserver.enableCORSForAllResponses=true \
    -Dmockserver.corsAllowMethods="CONNECT, DELETE, GET, HEAD, OPTIONS, POST, PUT, PATCH, TRACE" \
    -Dmockserver.corsAllowHeaders="Allow, Content-Encoding, Content-Length, Content-Type, ETag, Expires, Last-Modified, Location, Server, Vary, Authorization" \
    -Dmockserver.corsAllowCredentials="true" \
    -Dmockserver.corsMaxAgeInSeconds="300" \
    -jar "~/Downloads/mockserver-netty-{{ site.mockserver_version }}-no-dependencies.jar" -serverPort 1080

    var mockserver = require('mockserver-node');
    mockserver.start_mockserver({
        serverPort: 1080,
        systemProperties: "-Dmockserver.enableCORSForAllResponses=true " +
            "-Dmockserver.corsAllowMethods=\"CONNECT, DELETE, GET, HEAD, OPTIONS, POST, PUT, PATCH, TRACE\" " +
            "-Dmockserver.corsAllowHeaders=\"Allow, Content-Encoding, Content-Length, Content-Type, ETag, Expires, Last-Modified, Location, Server, Vary, Authorization\" " +
            "-Dmockserver.corsAllowCredentials=\"true\" " +
            "-Dmockserver.corsMaxAgeInSeconds=\"300\""
    });

    ConfigurationProperties.enableCORSForAPI(true);
    ConfigurationProperties.corsAllowMethods("CONNECT, DELETE, GET, HEAD, OPTIONS, POST, PUT, PATCH, TRACE");
    ConfigurationProperties.corsAllowHeaders("Allow, Content-Encoding, Content-Length, Content-Type, ETag, Expires, Last-Modified, Location, Server, Vary, Authorization");
    ConfigurationProperties.corsAllowCredentials(true);
    ConfigurationProperties.corsMaxAgeInSeconds(300);

    java -Dmockserver.enableCORSForAPI=true \
    -Dmockserver.corsAllowMethods="CONNECT, DELETE, GET, HEAD, OPTIONS, POST, PUT, PATCH, TRACE" \
    -Dmockserver.corsAllowHeaders="Allow, Content-Encoding, Content-Length, Content-Type, ETag, Expires, Last-Modified, Location, Server, Vary, Authorization" \
    -Dmockserver.corsAllowCredentials="true" \
    -Dmockserver.corsMaxAgeInSeconds="300" \
    -jar "~/Downloads/mockserver-netty-{{ site.mockserver_version }}-no-dependencies.jar" -serverPort 1080

    var mockserver = require('mockserver-node');
    mockserver.start_mockserver({
        serverPort: 1080,
        systemProperties: "-Dmockserver.enableCORSForAPI=true " +
            "-Dmockserver.corsAllowMethods=\"CONNECT, DELETE, GET, HEAD, OPTIONS, POST, PUT, PATCH, TRACE\" " +
            "-Dmockserver.corsAllowHeaders=\"Allow, Content-Encoding, Content-Length, Content-Type, ETag, Expires, Last-Modified, Location, Server, Vary, Authorization\" " +
            "-Dmockserver.corsAllowCredentials=\"true\" " +
            "-Dmockserver.corsMaxAgeInSeconds=\"300\""
    });