| description |
|---|
This page discusses the improved response to origin validation |
When using the legacy execution engine, you can configure Cross-Origin Resource Sharing (CORS) to allow a specific subset of origins. Regardless of the actual configuration, the Gateway properly validates the origin but returns Access-Control-Allowed-Origin: * in the response header.
When using the reactive execution engine, the allowed origin(s) you specify is returned instead of *. For example, in the configuration shown below, Access-Control-Allowed-Origin: https://test.gravitee.io.
Sample CORS configuration