Log in to mPaaS console and complete the following steps: The rules are configured in the dimension of appId + workspaceId. MGS provides the function of configuring CORS rules, which allows the business system to decide whether to allow specific cross-origin requests. The above actions are done by the browser automatically, the server only needs to configure the specific CORS rules. The pre-check request sends some formal information to the server attached in the request header, which mainly include:Īccess-Control-Request-Method: Request type of the following request, such as POST, GET, and so on.Īccess-Control-Request-Headers: The explicit headers list in the following request.Īfter receiving the pre-check request, the server will determine whether to allow cross-origin request according to the information attached in the header, and return the corresponding information through the response header:Īccess-Control-Allow-Origin: Allow the cross-origin Origin list.Īccess-Control-Allow-Methods: Allow the cross-origin method list.Īccess-Control-Allow-Headers: Allow the cross-origin Header list.Īccess-Control-Expose-Headers: Allow the exposed Header list.Īccess-Control-Max-Age: The maximum browser cache time, in seconds.Īccess-Control-Allow-Credentials: Whether to allow to send Cookie.Īnd the browser will determine whether to continue sending the actual request according to the returned CORS information. This kind of request is Pre-check request.

The value of Content-Type is no more than the following types:įor all the requests that do not meet the conditions for simple request, before actual communication, an OPTIONS request is triggered for pre-check. HTTP header information contains no more than the following fields: Simple request meets the following conditions: Once the cross-origin request is confirmed allowed, the actual HTTP request will be initiated. The browser sends a pre-check request by OPTIONS method before sending actual request, in order to know whether the server allows the cross-origin request. Pre-check request: A protection mechanism to prevent resource from being modified by unauthorized requests. The browser divides the CROS requests into the following two types: Thus, W3C has provided a standard solution for cross-origin: Cross-Origin Resource Sharing (CORS), which supports the secured cross-origin request and data transmission.

But in actual practice, cross-origin access often occurs. The browser sets the same-origin policy for security reasons, which limits the cross-origin requests from within the script. Cross-origin access refers to request a resource with a different source (different domain name, protocol, or port) from its own resource.

Access control allow origin multiple