You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@apisix.apache.org by "Yilialinn (via GitHub)" <gi...@apache.org> on 2026/04/20 08:37:39 UTC
[PR] docs(cors): re-port with Admin API, ADC, and Ingress Controller tabs [apisix]
Yilialinn opened a new pull request, #13261:
URL: https://github.com/apache/apisix/pull/13261
Re-ports the cors plugin documentation with Admin API, ADC, and Ingress Controller tab structure, corrected attribute table (fixed expose_headers default/description, allow_credential default type and description typo, plugin_metadata allow_origins type), and canonical link. Also adds missing timing_allow_origins and timing_allow_origins_by_regex attributes to ZH doc.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] docs(cors): re-port with Admin API, ADC, and Ingress Controller tabs [apisix]
Posted by "Copilot (via GitHub)" <gi...@apache.org>.
Copilot commented on code in PR #13261:
URL: https://github.com/apache/apisix/pull/13261#discussion_r3115345870
##########
docs/zh/latest/plugins/cors.md:
##########
@@ -52,76 +61,766 @@ description: 本文介绍了 Apache APISIX cors 插件的基本信息及使用
## 元数据
-| 名称 | 类型 | 必选项 | 描述 |
-| ----------- | ------ | ------ | ------------------ |
-| allow_origins | object | 否 | 定义允许跨域访问的 Origin；它的键为 `allow_origins_by_metadata` 使用的引用键，值则为允许跨域访问的 Origin，其语义与属性中的 `allow_origins` 相同。 |
-
-## 启用插件
+| 名称 | 类型 | 必选项 | 默认值 | 有效值 | 描述 |
+|---|---|---|---|---|---|
+| allow_origins | object | 否 | | | 定义允许跨域访问的 Origin 映射表；其键为 `allow_origins_by_metadata` 使用的引用键，值则为允许跨域访问的 Origin，其语义与属性中的 `allow_origins` 相同。 |
-你可以在路由或服务上启用 `cors` 插件。
+## 示例
-你可以通过如下命令在指定路由上启用 `cors` 插件：
+以下示例展示了如何针对不同场景配置 `cors` 插件。
:::note
您可以这样从 `config.yaml` 中获取 `admin_key` 并存入环境变量：
```bash
-admin_key=$(yq '.deployment.admin.admin_key[0].key' conf/config.yaml | sed 's/"//g')
+admin_key=$(yq '.deployment.admin.admin_key[0].key' /usr/local/apisix/conf/config.yaml | sed 's/"//g')
Review Comment:
`admin_key` 示例中使用了固定路径 `/usr/local/apisix/conf/config.yaml`，这与仓库中其他插件文档普遍使用的 `conf/config.yaml` 不一致（例如 `docs/zh/latest/plugins/basic-auth.md:69`）。固定绝对路径可能在不同安装方式下不存在；建议改回 `conf/config.yaml`，或明确说明配置文件路径取决于安装方式。
```suggestion
admin_key=$(yq '.deployment.admin.admin_key[0].key' conf/config.yaml | sed 's/"//g')
```
##########
docs/zh/latest/plugins/cors.md:
##########
@@ -52,76 +61,766 @@ description: 本文介绍了 Apache APISIX cors 插件的基本信息及使用
## 元数据
-| 名称 | 类型 | 必选项 | 描述 |
-| ----------- | ------ | ------ | ------------------ |
-| allow_origins | object | 否 | 定义允许跨域访问的 Origin；它的键为 `allow_origins_by_metadata` 使用的引用键，值则为允许跨域访问的 Origin，其语义与属性中的 `allow_origins` 相同。 |
-
-## 启用插件
+| 名称 | 类型 | 必选项 | 默认值 | 有效值 | 描述 |
+|---|---|---|---|---|---|
+| allow_origins | object | 否 | | | 定义允许跨域访问的 Origin 映射表；其键为 `allow_origins_by_metadata` 使用的引用键，值则为允许跨域访问的 Origin，其语义与属性中的 `allow_origins` 相同。 |
-你可以在路由或服务上启用 `cors` 插件。
+## 示例
-你可以通过如下命令在指定路由上启用 `cors` 插件：
+以下示例展示了如何针对不同场景配置 `cors` 插件。
:::note
您可以这样从 `config.yaml` 中获取 `admin_key` 并存入环境变量：
```bash
-admin_key=$(yq '.deployment.admin.admin_key[0].key' conf/config.yaml | sed 's/"//g')
+admin_key=$(yq '.deployment.admin.admin_key[0].key' /usr/local/apisix/conf/config.yaml | sed 's/"//g')
```
:::
+### 为路由启用 CORS
+
+以下示例展示如何在路由上启用 CORS，允许来自指定 Origin 列表的资源加载。
+
+<Tabs
+groupId="api"
+defaultValue="admin-api"
+values={[
+{label: 'Admin API', value: 'admin-api'},
+{label: 'ADC', value: 'adc'},
+{label: 'Ingress Controller', value: 'aic'}
+]}>
+
+<TabItem value="admin-api">
+
+创建带有 `cors` 插件的路由：
+
```shell
-curl http://127.0.0.1:9180/apisix/admin/routes/1 -H "X-API-KEY: $admin_key" -X PUT -d '
-{
- "uri": "/hello",
+curl "http://127.0.0.1:9180/apisix/admin/routes" -X PUT \
+ -H "X-API-KEY: ${admin_key}" \
+ -d '{
+ "id": "cors-route",
+ "uri": "/anything",
"plugins": {
- "cors": {}
+ "cors": {
+ "allow_origins": "http://sub.domain.com,http://sub2.domain.com",
+ "allow_methods": "GET,POST",
+ "allow_headers": "headr1,headr2",
+ "expose_headers": "ex-headr1,ex-headr2",
Review Comment:
示例中的 Header 占位符拼写为 `headr1/headr2`（以及 `ex-headr1/ex-headr2`），看起来像拼写错误，可能会让读者困惑。建议统一改为 `header1/header2`（以及 `ex-header1/ex-header2`）。
```suggestion
"allow_headers": "header1,header2",
"expose_headers": "ex-header1,ex-header2",
```
##########
docs/en/latest/plugins/cors.md:
##########
@@ -26,117 +26,801 @@ description: This document contains information about the Apache APISIX cors Plu
#
-->
+<head>
+ <link rel="canonical" href="https://docs.api7.ai/hub/cors" />
+</head>
+
+import Tabs from '@theme/Tabs';
+import TabItem from '@theme/TabItem';
+
## Description
-The `cors` Plugins lets you enable [CORS](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS) easily.
+The `cors` plugin allows you to enable [Cross-Origin Resource Sharing (CORS)](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS). CORS is an HTTP-header based mechanism which allows a server to specify any origins (domain, scheme, or port) other than its own, and instructs browsers to allow the loading of resources from those origins.
## Attributes
-### CORS attributes
-
-| Name | Type | Required | Default | Description |
-|---------------------------|---------|----------|---------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| allow_origins | string | False | "*" | Origins to allow CORS. Use the `scheme://host:port` format. For example, `https://somedomain.com:8081`. If you have multiple origins, use a `,` to list them. If `allow_credential` is set to `false`, you can enable CORS for all origins by using `*`. If `allow_credential` is set to `true`, you can forcefully allow CORS on all origins by using `**` but it will pose some security issues. |
-| allow_methods | string | False | "*" | Request methods to enable CORS on. For example `GET`, `POST`. Use `,` to add multiple methods. If `allow_credential` is set to `false`, you can enable CORS for all methods by using `*`. If `allow_credential` is set to `true`, you can forcefully allow CORS on all methods by using `**` but it will pose some security issues. |
-| allow_headers | string | False | "*" | Headers in the request allowed when accessing a cross-origin resource. Use `,` to add multiple headers. If `allow_credential` is set to `false`, you can enable CORS for all request headers by using `*`. If `allow_credential` is set to `true`, you can forcefully allow CORS on all request headers by using `**` but it will pose some security issues. |
-| expose_headers | string | False | | Headers in the response allowed when accessing a cross-origin resource. Use `,` to add multiple headers. If `allow_credential` is set to `false`, you can enable CORS for all response headers by using `*`. If not specified, the plugin will not modify the `Access-Control-Expose-Headers header`. See [Access-Control-Expose-Headers - MDN](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Expose-Headers) for more details. |
-| max_age | integer | False | 5 | Maximum time in seconds the result is cached. If the time is within this limit, the browser will check the cached result. Set to `-1` to disable caching. Note that the maximum value is browser dependent. See [Access-Control-Max-Age](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Max-Age#Directives) for more details. |
-| allow_credential | boolean | False | false | When set to `true`, allows requests to include credentials like cookies. According to CORS specification, if you set this to `true`, you cannot use '*' to allow all for the other attributes. |
-| allow_origins_by_regex | array | False | nil | Regex to match origins that allow CORS. For example, `[".*\.test.com$"]` can match all subdomains of `test.com`. When set to specified range, only domains in this range will be allowed, no matter what `allow_origins` is. |
-| allow_origins_by_metadata | array | False | nil | Origins to enable CORS referenced from `allow_origins` set in the Plugin metadata. For example, if `"allow_origins": {"EXAMPLE": "https://example.com"}` is set in the Plugin metadata, then `["EXAMPLE"]` can be used to allow CORS on the origin `https://example.com`. |
+| Name | Type | Required | Default | Valid values | Description |
+|---|---|---|---|---|---|
+| allow_origins | string | False | `"*"` | | Comma-separated string of origins to allow CORS, in the format `scheme://host:port`, for example `https://somedomain.com:8081`. If you have multiple origins, use `,` to list them. If `allow_credential` is set to `false`, you can use `*` to allow all origins. If `allow_credential` is set to `true`, you can use `**` to forcefully allow all origins, but this poses security risks. |
+| allow_methods | string | False | `"*"` | | Comma-separated string of HTTP request methods to allow CORS, for example `GET`, `POST`. If `allow_credential` is set to `false`, you can use `*` to allow all methods. If `allow_credential` is set to `true`, you can use `**` to forcefully allow all methods, but this poses security risks. |
+| allow_headers | string | False | `"*"` | | Comma-separated string of HTTP headers allowed in requests when accessing a cross-origin resource. If `allow_credential` is set to `false`, you can use `*` to allow all request headers. If `allow_credential` is set to `true`, you can use `**` to forcefully allow all request headers, but this poses security risks. |
+| expose_headers | string | False | | | Comma-separated string of HTTP headers that should be made available in response to a cross-origin request. If `allow_credential` is set to `false`, you can use `*` to allow all response headers. If not specified, the Plugin will not modify the `Access-Control-Expose-Headers` header. See [Access-Control-Expose-Headers - MDN](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Expose-Headers) for more details. |
+| max_age | integer | False | 5 | | Maximum time in seconds for which the results of a preflight request can be cached. If the time is within this limit, the browser will check the cached result. Set to `-1` to disable caching. Note that the maximum value is browser-dependent. See [Access-Control-Max-Age](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Max-Age#Directives) for more details. |
+| allow_credential | boolean | False | false | | When set to `true`, allows requests to include credentials such as cookies. According to CORS specification, if you set this to `true`, you cannot use `*` for other CORS attributes. |
+| allow_origins_by_regex | array | False | | | Regex to match origins that allow CORS. For example, `[".*\.test.com$"]` can match all subdomains of `test.com`. When configured, only domains matching the RegEx will be allowed and `allow_origins` will be ignored. |
+| allow_origins_by_metadata | array | False | | | Origins to enable CORS referenced from `allow_origins` set in the Plugin metadata. For example, if `"allow_origins": {"EXAMPLE": "https://example.com"}` is set in the Plugin metadata, then `["EXAMPLE"]` can be used to allow CORS on the origin `https://example.com`. |
+| timing_allow_origins | string | False | | | Comma-separated string of origins to allow access to the resource timing information. See [Timing-Allow-Origin](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Timing-Allow-Origin) for more details. |
+| timing_allow_origins_by_regex | array | False | | | Regex to match origins for enabling access to the resource timing information. For example, `[".*\.test.com"]` can match all subdomains of `test.com`. When configured, only domains matching the RegEx will be allowed and `timing_allow_origins` will be ignored. |
:::info IMPORTANT
-1. The `allow_credential` attribute is sensitive and must be used carefully. If set to `true` the default value `*` of the other attributes will be invalid and they should be specified explicitly.
+1. The `allow_credential` attribute is sensitive and must be used carefully. If set to `true`, the default value `*` of the other attributes will be invalid and they should be specified explicitly.
2. When using `**` you are vulnerable to security risks like CSRF. Make sure that this meets your security levels before using it.
:::
-### Resource Timing attributes
+## Metadata
+
+| Name | Type | Required | Default | Valid values | Description |
+|---|---|---|---|---|---|
+| allow_origins | object | False | | | A map of keys and allowed origins. The keys are used in the `allow_origins_by_metadata` attribute and the values are equivalent to the `allow_origins` attribute of the Plugin. |
+
+## Examples
-| Name | Type | Required | Default | Description |
-|---------------------------|---------|----------|---------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| timing_allow_origins | string | False | nil | Origin to allow to access the resource timing information. See [Timing-Allow-Origin](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Timing-Allow-Origin). Use the `scheme://host:port` format. For example, `https://somedomain.com:8081`. If you have multiple origins, use a `,` to list them. |
-| timing_allow_origins_by_regex | array | False | nil | Regex to match with origin for enabling access to the resource timing information. For example, `[".*\.test.com"]` can match all subdomain of `test.com`. When set to specified range, only domains in this range will be allowed, no matter what `timing_allow_origins` is. |
+The examples below demonstrate how you can configure the `cors` Plugin for different scenarios.
:::note
-The Timing-Allow-Origin header is defined in the Resource Timing API, but it is related to the CORS concept.
+You can fetch the `admin_key` from `config.yaml` and save to an environment variable with the following command:
-Suppose you have 2 domains, `domain-A.com` and `domain-B.com`.
-You are on a page on `domain-A.com`, you have an XHR call to a resource on `domain-B.com` and you need its timing information.
-You can allow the browser to show this timing information only if you have cross-origin permissions on `domain-B.com`.
-So, you have to set the CORS headers first, then access the `domain-B.com` URL, and if you set [Timing-Allow-Origin](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Timing-Allow-Origin), the browser will show the requested timing information.
+```bash
+admin_key=$(yq '.deployment.admin.admin_key[0].key' /usr/local/apisix/conf/config.yaml | sed 's/"//g')
Review Comment:
The `admin_key` extraction example hard-codes `/usr/local/apisix/conf/config.yaml`, which is inconsistent with the rest of the docs that reference `conf/config.yaml` (for example, `docs/en/latest/plugins/basic-auth.md:69`). This absolute path may not exist in many installations; consider switching back to `conf/config.yaml` or explicitly noting that the config path is installation-dependent.
```suggestion
admin_key=$(yq '.deployment.admin.admin_key[0].key' conf/config.yaml | sed 's/"//g')
```
##########
docs/en/latest/plugins/cors.md:
##########
@@ -26,117 +26,801 @@ description: This document contains information about the Apache APISIX cors Plu
#
-->
+<head>
+ <link rel="canonical" href="https://docs.api7.ai/hub/cors" />
+</head>
+
+import Tabs from '@theme/Tabs';
+import TabItem from '@theme/TabItem';
+
## Description
-The `cors` Plugins lets you enable [CORS](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS) easily.
+The `cors` plugin allows you to enable [Cross-Origin Resource Sharing (CORS)](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS). CORS is an HTTP-header based mechanism which allows a server to specify any origins (domain, scheme, or port) other than its own, and instructs browsers to allow the loading of resources from those origins.
## Attributes
-### CORS attributes
-
-| Name | Type | Required | Default | Description |
-|---------------------------|---------|----------|---------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| allow_origins | string | False | "*" | Origins to allow CORS. Use the `scheme://host:port` format. For example, `https://somedomain.com:8081`. If you have multiple origins, use a `,` to list them. If `allow_credential` is set to `false`, you can enable CORS for all origins by using `*`. If `allow_credential` is set to `true`, you can forcefully allow CORS on all origins by using `**` but it will pose some security issues. |
-| allow_methods | string | False | "*" | Request methods to enable CORS on. For example `GET`, `POST`. Use `,` to add multiple methods. If `allow_credential` is set to `false`, you can enable CORS for all methods by using `*`. If `allow_credential` is set to `true`, you can forcefully allow CORS on all methods by using `**` but it will pose some security issues. |
-| allow_headers | string | False | "*" | Headers in the request allowed when accessing a cross-origin resource. Use `,` to add multiple headers. If `allow_credential` is set to `false`, you can enable CORS for all request headers by using `*`. If `allow_credential` is set to `true`, you can forcefully allow CORS on all request headers by using `**` but it will pose some security issues. |
-| expose_headers | string | False | | Headers in the response allowed when accessing a cross-origin resource. Use `,` to add multiple headers. If `allow_credential` is set to `false`, you can enable CORS for all response headers by using `*`. If not specified, the plugin will not modify the `Access-Control-Expose-Headers header`. See [Access-Control-Expose-Headers - MDN](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Expose-Headers) for more details. |
-| max_age | integer | False | 5 | Maximum time in seconds the result is cached. If the time is within this limit, the browser will check the cached result. Set to `-1` to disable caching. Note that the maximum value is browser dependent. See [Access-Control-Max-Age](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Max-Age#Directives) for more details. |
-| allow_credential | boolean | False | false | When set to `true`, allows requests to include credentials like cookies. According to CORS specification, if you set this to `true`, you cannot use '*' to allow all for the other attributes. |
-| allow_origins_by_regex | array | False | nil | Regex to match origins that allow CORS. For example, `[".*\.test.com$"]` can match all subdomains of `test.com`. When set to specified range, only domains in this range will be allowed, no matter what `allow_origins` is. |
-| allow_origins_by_metadata | array | False | nil | Origins to enable CORS referenced from `allow_origins` set in the Plugin metadata. For example, if `"allow_origins": {"EXAMPLE": "https://example.com"}` is set in the Plugin metadata, then `["EXAMPLE"]` can be used to allow CORS on the origin `https://example.com`. |
+| Name | Type | Required | Default | Valid values | Description |
+|---|---|---|---|---|---|
+| allow_origins | string | False | `"*"` | | Comma-separated string of origins to allow CORS, in the format `scheme://host:port`, for example `https://somedomain.com:8081`. If you have multiple origins, use `,` to list them. If `allow_credential` is set to `false`, you can use `*` to allow all origins. If `allow_credential` is set to `true`, you can use `**` to forcefully allow all origins, but this poses security risks. |
+| allow_methods | string | False | `"*"` | | Comma-separated string of HTTP request methods to allow CORS, for example `GET`, `POST`. If `allow_credential` is set to `false`, you can use `*` to allow all methods. If `allow_credential` is set to `true`, you can use `**` to forcefully allow all methods, but this poses security risks. |
+| allow_headers | string | False | `"*"` | | Comma-separated string of HTTP headers allowed in requests when accessing a cross-origin resource. If `allow_credential` is set to `false`, you can use `*` to allow all request headers. If `allow_credential` is set to `true`, you can use `**` to forcefully allow all request headers, but this poses security risks. |
+| expose_headers | string | False | | | Comma-separated string of HTTP headers that should be made available in response to a cross-origin request. If `allow_credential` is set to `false`, you can use `*` to allow all response headers. If not specified, the Plugin will not modify the `Access-Control-Expose-Headers` header. See [Access-Control-Expose-Headers - MDN](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Expose-Headers) for more details. |
+| max_age | integer | False | 5 | | Maximum time in seconds for which the results of a preflight request can be cached. If the time is within this limit, the browser will check the cached result. Set to `-1` to disable caching. Note that the maximum value is browser-dependent. See [Access-Control-Max-Age](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Max-Age#Directives) for more details. |
+| allow_credential | boolean | False | false | | When set to `true`, allows requests to include credentials such as cookies. According to CORS specification, if you set this to `true`, you cannot use `*` for other CORS attributes. |
+| allow_origins_by_regex | array | False | | | Regex to match origins that allow CORS. For example, `[".*\.test.com$"]` can match all subdomains of `test.com`. When configured, only domains matching the RegEx will be allowed and `allow_origins` will be ignored. |
+| allow_origins_by_metadata | array | False | | | Origins to enable CORS referenced from `allow_origins` set in the Plugin metadata. For example, if `"allow_origins": {"EXAMPLE": "https://example.com"}` is set in the Plugin metadata, then `["EXAMPLE"]` can be used to allow CORS on the origin `https://example.com`. |
+| timing_allow_origins | string | False | | | Comma-separated string of origins to allow access to the resource timing information. See [Timing-Allow-Origin](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Timing-Allow-Origin) for more details. |
+| timing_allow_origins_by_regex | array | False | | | Regex to match origins for enabling access to the resource timing information. For example, `[".*\.test.com"]` can match all subdomains of `test.com`. When configured, only domains matching the RegEx will be allowed and `timing_allow_origins` will be ignored. |
:::info IMPORTANT
-1. The `allow_credential` attribute is sensitive and must be used carefully. If set to `true` the default value `*` of the other attributes will be invalid and they should be specified explicitly.
+1. The `allow_credential` attribute is sensitive and must be used carefully. If set to `true`, the default value `*` of the other attributes will be invalid and they should be specified explicitly.
2. When using `**` you are vulnerable to security risks like CSRF. Make sure that this meets your security levels before using it.
:::
-### Resource Timing attributes
+## Metadata
+
+| Name | Type | Required | Default | Valid values | Description |
+|---|---|---|---|---|---|
+| allow_origins | object | False | | | A map of keys and allowed origins. The keys are used in the `allow_origins_by_metadata` attribute and the values are equivalent to the `allow_origins` attribute of the Plugin. |
+
+## Examples
-| Name | Type | Required | Default | Description |
-|---------------------------|---------|----------|---------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| timing_allow_origins | string | False | nil | Origin to allow to access the resource timing information. See [Timing-Allow-Origin](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Timing-Allow-Origin). Use the `scheme://host:port` format. For example, `https://somedomain.com:8081`. If you have multiple origins, use a `,` to list them. |
-| timing_allow_origins_by_regex | array | False | nil | Regex to match with origin for enabling access to the resource timing information. For example, `[".*\.test.com"]` can match all subdomain of `test.com`. When set to specified range, only domains in this range will be allowed, no matter what `timing_allow_origins` is. |
+The examples below demonstrate how you can configure the `cors` Plugin for different scenarios.
:::note
-The Timing-Allow-Origin header is defined in the Resource Timing API, but it is related to the CORS concept.
+You can fetch the `admin_key` from `config.yaml` and save to an environment variable with the following command:
-Suppose you have 2 domains, `domain-A.com` and `domain-B.com`.
-You are on a page on `domain-A.com`, you have an XHR call to a resource on `domain-B.com` and you need its timing information.
-You can allow the browser to show this timing information only if you have cross-origin permissions on `domain-B.com`.
-So, you have to set the CORS headers first, then access the `domain-B.com` URL, and if you set [Timing-Allow-Origin](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Timing-Allow-Origin), the browser will show the requested timing information.
+```bash
+admin_key=$(yq '.deployment.admin.admin_key[0].key' /usr/local/apisix/conf/config.yaml | sed 's/"//g')
+```
:::
-## Metadata
+### Enable CORS for a Route
-| Name | Type | Required | Description |
-|---------------|--------|----------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| allow_origins | object | False | A map with origin reference and allowed origins. The keys in the map are used in the attribute `allow_origins_by_metadata` and the value are equivalent to the `allow_origins` attribute of the Plugin. |
+The following example demonstrates how to enable CORS on a Route to allow resource loading from a list of origins.
-## Enable Plugin
+<Tabs
+groupId="api"
+defaultValue="admin-api"
+values={[
+{label: 'Admin API', value: 'admin-api'},
+{label: 'ADC', value: 'adc'},
+{label: 'Ingress Controller', value: 'aic'}
+]}>
-You can enable the Plugin on a specific Route or Service:
+<TabItem value="admin-api">
-:::note
-You can fetch the `admin_key` from `config.yaml` and save to an environment variable with the following command:
+Create a Route with the `cors` Plugin:
-```bash
-admin_key=$(yq '.deployment.admin.admin_key[0].key' conf/config.yaml | sed 's/"//g')
+```shell
+curl "http://127.0.0.1:9180/apisix/admin/routes" -X PUT \
+ -H "X-API-KEY: ${admin_key}" \
+ -d '{
+ "id": "cors-route",
+ "uri": "/anything",
+ "plugins": {
+ "cors": {
+ "allow_origins": "http://sub.domain.com,http://sub2.domain.com",
+ "allow_methods": "GET,POST",
+ "allow_headers": "headr1,headr2",
+ "expose_headers": "ex-headr1,ex-headr2",
Review Comment:
In the examples, placeholder header names are misspelled as `headr1/headr2` (and `ex-headr1/ex-headr2`). This reads like a typo and may confuse readers; consider renaming to `header1/header2` (and `ex-header1/ex-header2`) consistently throughout the page.
```suggestion
"allow_headers": "header1,header2",
"expose_headers": "ex-header1,ex-header2",
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] docs(cors): re-port with Admin API, ADC, and Ingress Controller tabs [apisix]
Posted by "Yilialinn (via GitHub)" <gi...@apache.org>.
Yilialinn merged PR #13261:
URL: https://github.com/apache/apisix/pull/13261
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] docs(cors): re-port with Admin API, ADC, and Ingress Controller tabs [apisix]
Posted by "Copilot (via GitHub)" <gi...@apache.org>.
Copilot commented on code in PR #13261:
URL: https://github.com/apache/apisix/pull/13261#discussion_r3109472052
##########
docs/en/latest/plugins/ua-restriction.md:
##########
@@ -30,18 +30,21 @@ description: The ua-restriction Plugin restricts access to upstream resources us
<link rel="canonical" href="https://docs.api7.ai/hub/ua-restriction" />
</head>
+import Tabs from '@theme/Tabs';
+import TabItem from '@theme/TabItem';
+
Review Comment:
In MDX, `import` statements must appear before any other content (including JSX/HTML like `<head>` blocks). Placing imports after `</head>` can cause MDX compilation errors. Move these imports to the top of the document (right after frontmatter, before the `<head>` block). This same pattern appears in the other modified docs as well.
##########
docs/en/latest/plugins/ip-restriction.md:
##########
@@ -94,6 +102,156 @@ curl "http://127.0.0.1:9180/apisix/admin/routes" -X PUT \
}'
```
+</TabItem>
+
+<TabItem value="adc">
+
+```yaml title="adc.yaml"
+services:
+ - name: ip-restriction-service
+ routes:
+ - name: ip-restriction-route
+ uris:
+ - /anything
+ plugins:
+ ip-restriction:
+ whitelist:
+ - "192.168.0.1/24"
+ message: "Access denied"
+ upstream:
+ type: roundrobin
+ nodes:
+ - host: httpbin.org
+ port: 80
+ weight: 1
+```
+
+Synchronize the configuration to the gateway:
+
+```shell
+adc sync -f adc.yaml
+```
+
+</TabItem>
+
+<TabItem value="aic">
+
+<Tabs
+groupId="k8s-api"
+defaultValue="gateway-api"
+values={[
+{label: 'Gateway API', value: 'gateway-api'},
+{label: 'APISIX Ingress Controller', value: 'apisix-crd'}
+]}>
Review Comment:
The nested Kubernetes tabs use `groupId=\"k8s-api\"` but the tab value key here is `apisix-crd`, while other updated pages use `apisix-ingress-controller` for the same label. With a shared `groupId`, inconsistent `value` keys prevent tab persistence from working consistently across pages. Consider standardizing the `value` keys across docs (recommended), or use a different `groupId` per page if the options are intentionally different.
##########
docs/en/latest/plugins/ua-restriction.md:
##########
@@ -52,7 +55,7 @@ The examples below demonstrate how you can configure `ua-restriction` for differ
You can fetch the `admin_key` from `config.yaml` and save to an environment variable with the following command:
```bash
-admin_key=$(yq '.deployment.admin.admin_key[0].key' conf/config.yaml | sed 's/"//g')
+admin_key=$(yq '.deployment.admin.admin_key[0].key' /usr/local/apisix/conf/config.yaml | sed 's/"//g')
Review Comment:
This hardcodes an install-specific APISIX config path (`/usr/local/apisix/conf/config.yaml`). Since other docs/examples still reference `conf/config.yaml`, this becomes inconsistent and may not work for users with different layouts. Consider reverting to the relative path, or explicitly note that the path should be adjusted to match the user’s installation (and keep it consistent across plugin docs).
```suggestion
admin_key=$(yq '.deployment.admin.admin_key[0].key' conf/config.yaml | sed 's/"//g')
```
##########
docs/en/latest/plugins/ua-restriction.md:
##########
@@ -30,18 +30,21 @@ description: The ua-restriction Plugin restricts access to upstream resources us
<link rel="canonical" href="https://docs.api7.ai/hub/ua-restriction" />
</head>
+import Tabs from '@theme/Tabs';
+import TabItem from '@theme/TabItem';
+
## Description
The `ua-restriction` Plugin supports restricting access to upstream resources through either configuring an allowlist or denylist of user agents. A common use case is to prevent web crawlers from overloading the upstream resources and causing service degradation.
## Attributes
-| Name | Type | Required | Default | Valid values | Description |
-|----------------|---------------|----------|--------------|-------------------------|---------------------------------------------------------------------------------|
-| bypass_missing | boolean | False | false | | If true, bypass the user agent restriction check when the `User-Agent` header is missing. |
-| allowlist | array[string] | False | | | List of user agents to allow. Support regular expressions. At least one of the `allowlist` and `denylist` should be configured, but they cannot be configured at the same time. |
-| denylist | array[string] | False | | | List of user agents to deny. Support regular expressions. At least one of the `allowlist` and `denylist` should be configured, but they cannot be configured at the same time. |
-| message | string | False | "Not allowed" | | Message returned when the user agent is denied access. |
+| Name | Type | Required | Default | Valid values | Description |
+|----------------|---------------|----------|---------------|----------------|--------------------------------------------------------------------------------------------------------------------------------------|
+| bypass_missing | boolean | False | false | | If `true`, bypasses the UA restriction check when the `User-Agent` header is missing. |
+| allowlist | array[string] | False | | | List of allowed user agents (supports regex). Exactly one of `allowlist` or `denylist` must be configured. |
+| denylist | array[string] | False | | | List of denied user agents (supports regex). Exactly one of `allowlist` or `denylist` must be configured. |
+| message | string | False | "Not allowed" | [1, 1024] chars | Message returned to the client when the user agent is not allowed. |
Review Comment:
The `Valid values` column uses `[1, 1024] chars` here, while other tables use `[1, 1024]` (or `[1, 1024]` with localized units). Standardizing this format across docs (e.g., `1–1024 characters` or `[1, 1024]`) would reduce inconsistency.
```suggestion
| message | string | False | "Not allowed" | [1, 1024] | Message returned to the client when the user agent is not allowed. |
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org