4.7.1.3. CORS Settings

By default, all CORS requests to the REST API are allowed. To restrict the origins list you can define a global CORS configuration in the Spring configuration file. If the REST API is attached to the portal module then modify the portal-dispatcher-spring.xml, if the REST API is included in the web module then modify the web-spring.xml.

<mvc:cors>
    <mvc:mapping path="/api/**" allowed-origins="http://host1, http://host2"/>
</mvc:cors>