You enable cross-domain request enforcement as part of the Allowed URL properties within a security policy. Then you can specify which domains can access the response generated by requesting this URL (the “resource”), and also configure how to overwrite CORS response headers that are returned by the web server.
This feature does not affect internal redirection, which is always allowed. For example, Location: /anotherpage/onthisserver/internal_redirect.php would be allowed even if cross-domain request enforcement is enabled on the system.
The CORS-related headers that are included in a preflight request are:
|Origin||Determines requesting origin.|
|Access-Control-Request-Method||Indicates which methods are used in the actual request (other than simple methods).|
|Access-Control-Request-Headers||Indicates which headers are used in the actual request (other than simple headers).|
In response to the preflight request, the system uses these CORS response headers:
|Access-Control-Allow-Origin||List of origins the resource may be shared among (support wildcard).|
|Access-Control-Allow-Credentials||Indicates whether actual request may include user credentials (true/false).|
|Access-Control-Allow-Methods||Indicates which methods can be used during the actual request.|
|Access-Control-Allow-Headers||Indicates which request headers can be used during the actual request.|
|Access-Control-Max-Age||Indicates how long (in seconds) to cache the results of a preflight request in the browser.|
The browser then allows the foreign domain to send its original requests.
If you do not enable cross-domain request enforcement, the system removes all cross-origin request headers and CORS is not allowed for the URL.