///////////////////////////////////////////////////////////////////////////////

    Copyright (c) 2020 Oracle and/or its affiliates.

    Licensed under the Apache License, Version 2.0 (the "License");
    you may not use this file except in compliance with the License.
    You may obtain a copy of the License at

        http://www.apache.org/licenses/LICENSE-2.0

    Unless required by applicable law or agreed to in writing, software
    distributed under the License is distributed on an "AS IS" BASIS,
    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
    See the License for the specific language governing permissions and
    limitations under the License.

///////////////////////////////////////////////////////////////////////////////

= Using Configuration for CORS
:toc:
:toc-placement: preamble
:pagename: cors-mp-configuration
:description: Helidon MP CORS Configuration
:keywords: helidon, java, cors, mp, microprofile, configuration
:javadoc-base-url-api: {javadoc-base-url}io.helidon.microprofile.cors/io/helidon/microprofile/cors
:helidon-tag: https://github.com/oracle/helidon/tree/{helidon-version}
:quickstart-example: {helidon-tag}/examples/quickstarts/helidon-quickstart-mp
:cors-spec: https://www.w3.org/TR/cors/
:helidon-mp-cors-example: {helidon-tag}/examples/microprofile/cors
:cors-se: ../../se/cors
:cors-se-intro: {cors-se}/01_introduction.adoc
:cors-se-config: {cors-se}/02_configuration.adoc
:cors-config-table-src: {cors-se-intro}
:cors-mapped-config-src: {cors-se-config}
:mapped-config-top-key: cors
:cors-config-table-exclude-methods:

You and your users can override the annotated CORS set-up using MicroProfile configuration.

== Understanding the CORS Configuration Format [[cors-configuration-formats]]
The support in Helidon MP for CORS configuration works with the following format.

[[config-key-table]]
include::{cors-config-table-src}[tag=cors-config-table]

If the cross-origin configuration is disabled (`enabled` = false), then the Helidon CORS implementation ignores the cross-origin configuration entry.

Although there are two types of CORS cross-origin configuration, for Helidon MP use
the mapped format.

include::{cors-mapped-config-src}[tag=mapped-config]

The following example shows how you can express similar configuration using properties-file syntax
in your applications's `META-INF/microprofile-config.properties` file. Note that the top-level config key
must be `cors`.

[source,properties]
----
cors.paths.0.path-prefix = /greeting
cors.paths.0.allow-origins = http://foo.com, http://there.com, http://other.com
cors.paths.0.allow-methods = PUT, DELETE
cors.paths.1.path-prefix = /
cors.paths.1.allow-methods = GET, HEAD, OPTIONS, POST
----

== Next Steps

See the Helidon CORS support in action by building and running the link:{helidon-mp-cors-example}[CORS example].
