CORS

Cross-Origin Resource Sharing (CORS) headers are applied to all responses. This controls which websites can call your ZyveraWeb APIs from a browser.

Configuration

CORS origins are set in config.yml under api.cors-origins:

api:
  cors-origins:
    - "*"

Allow All Origins (Default)

api:
  cors-origins:
    - "*"

Any website can call your API from client-side JavaScript.

Restrict to Specific Domains

api:
  cors-origins:
    - "https://example.com"
    - "https://admin.example.com"

Only pages loaded from these domains can make browser fetch/XMLHttpRequest calls. All other origins receive no Access-Control-Allow-Origin header.

Block All Browser Access

api:
  cors-origins: []

An empty list omits the Access-Control-Allow-Origin header entirely, preventing any browser-based cross-origin requests. Server-side calls (curl, Python, GraalJS) are unaffected.

Important: CORS Only Affects Browsers

CORS is a browser-enforced security mechanism. Server-to-server requests:

• curl, wget
• Python requests, Java HttpClient
• GraalJS server.js (Node.js sites)
• Any non-browser HTTP client

...are never subject to CORS and can always reach your API regardless of the cors-origins setting.