How do I handle CORS regulations?

CORS is a security feature of web browser, preventing JavaScript to access external services. Here, we address the task to allow access to the Qanary system via its RESTful endpoints from an external browser-based application.

Enable the access for all endpoints

The Qanary systems provides a mechanism to configure the CORS restrictions.

Remove all CORS restrictions

Adding the following configuration to the application.properties or better application.local.properties will deactivates the CORS restrictions for all Qanary endpoints.

cors.global.disableAllRestrictions=true

The same effect can be achieved using a -D parameter while starting your Qanary system:

java -jar -Dcors.global.disableAllRestrictions=true ...

Also, starting a Docker container can be parameterized with the corresponding parameter:

docker run -e CORS_GLOBAL_DISABLEALLRESTRICTIONS=true ...

Specific definition of CORS rules parameters

The following environment variables can influence the behavior:

cors.global.addAllowedOrigin=
cors.global.addAllowedHeader=
cors.global.addAllowedMethod=
cors.global.addAllowedOriginPattern=
cors.global.endpointPattern=

Note: see CorsConfigurationOnCondition for implementation details.

⚠️	If cors.global.disableAllRestrictions=true is defined, then the specific CORS rules are ignored.