This is part of #378, since this is something possible in D8.2.x: https://www.drupal.org/node/2715637
As of Drupal 8.2, it's possible to opt in a particular site to enable CORS for responses served by Drupal.
(This is particularly helpful for fully decoupled Drupal sites which have JS that needs to talk to a Drupal 8 site's REST API. In such cases, that Drupal 8 instance often runs on a separate domain. Due to the same origin policy those requests will be blocked by the browser.)
This is not enabled by default because there are security consequences.
New in default.services.yml:
# Configure Cross-Site HTTP requests (CORS). # Read https://developer.mozilla.org/en-US/docs/Web/HTTP/Access_control_CORS # for more information about the topic in general. # Note: By default the configuration is disabled. cors.config: enabled: false # Specify allowed headers, like 'x-allowed-header'. allowedHeaders: [] # Specify allowed request methods, specify ['*'] to allow all possible ones. allowedMethods: [] # Configure requests allowed from specific origins. allowedOrigins: ['*'] # Sets the Access-Control-Expose-Headers header. exposedHeaders: false # Sets the Access-Control-Max-Age header. maxAge: false # Sets the Access-Control-Allow-Credentials header. supportsCredentials: false
Note particular that
enabled: false
key-value pair!
Recent comments
Hello @NumerousHats, I agree with your assessment. I am looking into this situation right now. The root of this problem is that Backdrop CMS is implemented on top of a "stack" of...
Update Core and Theme via Web interface
I just installed a Backdrop CMS site with version 1.27.0. I then used the user interface to download and update Backdrop CMS to 1.30.0. After starting the update process, and on the...
1.30.0 update.php generates incorrect link
I believe my permissions are set up correctly, as I can install modules from the UI. But for whatever reason, I can't update them. I will, however, double check against that documentation.
Update Core and Theme via Web interface