Hawkin
/
arangodb
mirror of https://gitee.com/bigwinds/arangodb
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Merge branch 'devel' of https://github.com/arangodb/arangodb into engine-api

This commit is contained in:
jsteemann 2017-03-31 15:25:42 +02:00
parent c038815941 40e9e9e35b
commit 7cf0f6b975
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
Documentation/Books/Manual/Foxx/Cors.mdpp
View File

@ -1,12 +1,12 @@
Cross-Origin Resource Sharing (CORS)
====================================
To use CORS in your Foxx services you first need to [configure ArangoDB for CORS](../../HTTP/General/README.md#cross-origin-resource-sharing-cors-requests). As of 3.2 Foxx will then automatically whitelist all response headers as they are used.
To use CORS in your Foxx services you first need to [configure ArangoDB for CORS](../../HTTP/General/index.html#cross-origin-resource-sharing-cors-requests). As of 3.2 Foxx will then automatically whitelist all response headers as they are used.
If you want more control over the whitelist or are using an older version of ArangoDB you can set the following response headers in your request handler:
* `access-control-expose-headers`: a comma-separated list of response headers. This defaults to a list of all headers the response is actually using (but not including any `access-control` headers).
* `access-control-allow-credentials`: can be set to `"false"` to forbid exposing cookies. The default value depends on whether ArangoDB trusts the origin. See the [notes on `http.trusted-origin`](../../HTTP/General/README.md#cookies-and-authentication).
* `access-control-allow-credentials`: can be set to `"false"` to forbid exposing cookies. The default value depends on whether ArangoDB trusts the origin. See the [notes on `http.trusted-origin`](../../HTTP/General/index.html#cookies-and-authentication).
Note that it is not possible to override these headers for the CORS preflight response. It is therefore not possible to accept credentials or cookies only for individual routes, services or databases. The origin needs to be trusted according to the general ArangoDB configuration (see above).