6.28.3 Configuring CORS

Micronaut supports CORS (Cross Origin Resource Sharing) out of the box. By default, CORS requests will be rejected. To enable processing of CORS requests, modify your configuration. For example with application.yml:

CORS Configuration Example

micronaut:
    server:
        cors:
            enabled: true

By only enabling CORS processing, a “wide open” strategy will be adopted that will allow requests from any origin.

To change the settings for all origins or a specific origin, change the configuration to provide a set of “configurations”. By providing any configuration, the default “wide open” configuration is not configured.

CORS Configurations (…​ is a placeholder)

micronaut:
    server:
        cors:
            enabled: true
            configurations:
                all:
                    ...
                web:
                    ...
                mobile:
                    ...

In the above example, three configurations are being provided. Their names (all, web, mobile) are not important and have no significance inside Micronaut. They are there purely to be able to easily recognize the intended user of the configuration.

The same configuration properties can be applied to each configuration. See CorsOriginConfiguration for the reference of properties that can be defined. Each configuration supplied will have its values default to the default values of the corresponding fields.

When a CORS request is made, configurations are searched for allowed origins that are an exact match or match the request origin through a regular expression.