[id='rest_cors']
= Cross-Origin Resource Sharing (CORS) Requests
The {brandname} REST connector supports
https://en.wikipedia.org/wiki/Cross-origin_resource_sharing[CORS], including
preflight and rules based on the request origin.

The following shows an example REST connector configuration with CORS rules:

[source,xml,options="nowrap",subs=attributes+]
----
<rest-connector name="rest1" socket-binding="rest" cache-container="default">
   <cors-rules>
      <cors-rule name="restrict host1"
                 allow-credentials="false">
         <allowed-origins>http://host1,https://host1</allowed-origins>
         <allowed-methods>GET</allowed-methods>
      </cors-rule>
      <cors-rule name="allow ALL"
                 allow-credentials="true"
                 max-age-seconds="2000">
         <allowed-origins>*</allowed-origins>
         <allowed-methods>GET,OPTIONS,POST,PUT,DELETE</allowed-methods>
         <allowed-headers>Key-Content-Type</allowed-headers>
      </cors-rule>
   </cors-rules>
</rest-connector>
----

{brandname} evaluates CORS rules sequentially based on the "Origin" header set
by the browser.

In the preceding example, if the origin is either "http://host1" or
"https://host1", then the rule "restrict host1" applies. If the origin is
different, then the next rule is tested.

Because the "allow ALL" rule permits all origins, any script that has an origin
other than "http://host1" or "https://host1" can perform the allowed methods
and use the supplied headers.

For information about configuring CORS rules, see the link:{configdocroot}[{brandname} Server Configuration Schema].
