8.4 CORS

8.4 CORS

Spring Boot provides CORS support out of the box, but it is difficult to configure in a Grails application due to the way UrlMappings are used instead of annotations that define URLs. Starting with Grails 3.2.1, we have added a way to configure CORS that makes sense in a Grails application.

Once enabled, the default setting is "wide open".

application.yml

grails:
    cors:
        enabled: true

That will produce a mapping to all urls /** with:

Some of these settings come directly from Spring Boot and can change in future versions. See Spring CORS Configuration Documentation

All of those settings can be easily overridden.

application.yml

grails:
    cors:
        enabled: true
        allowedOrigins:
            - http://localhost:5000

In the example above, the allowedOrigins setting will replace [*].

You can also configure different URLs.

application.yml

grails:
    cors:
        enabled: true
        allowedHeaders:
            - Content-Type
        mappings:
            /api/**:
                allowedOrigins:
                    - http://localhost:5000
                # Other configurations not specified default to the global config

The settings above will produce a single mapping of /api/** with the following settings:

If you don’t wish to override any of the default settings, but only want to specify URLs, you can do so like this example:

application.yml

grails:
    cors:
        enabled: true
        mappings:
            /api/**: inherit