CORS Support | MockServer

MockServer and the proxy have support for CORS, with two separate policies:

MockServer's own API (every /mockserver/... path, the dashboard's live log and the callback WebSocket) always answers CORS requests, but only from web pages it trusts: by default, pages on localhost, 127.0.0.1 or [::1] (any port, http or https) and pages MockServer serves itself, such as the dashboard, when MockServer is reached by localhost, an IP address, a single-word name, a name ending in .svc, .svc.cluster.local or .internal, or a controlPlaneTrustedHostSuffixes entry. Set controlPlaneCorsAllowOrigin to allow other origins. See which web pages can use MockServer's own API.
Mocked and proxied responses only get CORS headers when enableCORSForAllResponses is enabled, and then follow corsAllowOrigin.

When CORS is enabled for mocked responses, and the corsAllowMethods / corsAllowHeaders / corsAllowOrigin properties are left at their defaults (blank), MockServer emits:

Access-Control-Allow-Origin: <request Origin>   # the requesting Origin is reflected; "*" when there is no Origin
Access-Control-Allow-Methods: "CONNECT, DELETE, GET, HEAD, OPTIONS, POST, PUT, PATCH, TRACE"
Access-Control-Allow-Headers: "Allow, Content-Encoding, Content-Length, Content-Type, ETag, Expires, Last-Modified, Location, Server, Vary, Authorization"
Access-Control-Expose-Headers: "Allow, Content-Encoding, Content-Length, Content-Type, ETag, Expires, Last-Modified, Location, Server, Vary, Authorization"
Access-Control-Allow-Credentials: "false"
Access-Control-Max-Age: "0"

NOTE: for mocked responses the requesting Origin is reflected by default, so any site can read them. Set an explicit corsAllowOrigin to restrict which origin is permitted. This does not open MockServer's own API, which only controlPlaneCorsAllowOrigin does.

To reduce the security risk from cross-site requests, CORS headers should be configured to the minimum required values for your use case, using the CORS configuration properties, as below.

A more permission approach that enables most use cases would configure the CORS headers, as follows:

Access-Control-Allow-Origin: "*"
Access-Control-Allow-Methods: "CONNECT, DELETE, GET, HEAD, OPTIONS, POST, PUT, PATCH, TRACE"
Access-Control-Allow-Headers: "Allow, Content-Encoding, Content-Length, Content-Type, ETag, Expires, Last-Modified, Location, Server, Vary, Authorization"
Access-Control-Expose-Headers: "Allow, Content-Encoding, Content-Length, Content-Type, ETag, Expires, Last-Modified, Location, Server, Vary, Authorization"
Access-Control-Max-Age: "300"

For example to enable a more permission approach for cross-site requests use ConfigurationProperties class as follows:

ConfigurationProperties.enableCORSForAllResponses(true);
ConfigurationProperties.corsAllowOrigin("*");
ConfigurationProperties.corsAllowMethods("CONNECT, DELETE, GET, HEAD, OPTIONS, POST, PUT, PATCH, TRACE");
ConfigurationProperties.corsAllowHeaders("Allow, Content-Encoding, Content-Length, Content-Type, ETag, Expires, Last-Modified, Location, Server, Vary, Authorization");
ConfigurationProperties.corsMaxAgeInSeconds(300);

CORS Configuration:

Which web pages can use MockServer's own API. MockServer's own API (every /mockserver/... path, including MCP and metrics), the dashboard's live log and the callback WebSocket only answer browser pages they trust. This is set by controlPlaneCorsAllowOrigin. Left blank (the default), a page is trusted when it is:

on localhost, 127.0.0.1 or [::1], on any port, over http or https (for example a front-end dev server on http://localhost:3000 or a browser test), or
served by the same MockServer, at the same host and port, such as the dashboard, when you reach MockServer by localhost, an IP address, a single-word name such as a Docker, Compose or Kubernetes short service name (http://mockserver:1080), a Kubernetes service name ending in .svc or .svc.cluster.local, or a name ending in .internal (such as host.docker.internal or an AWS ec2.internal name).

A page MockServer serves at any other name, for example https://mockserver.example.com, is not trusted unless you list it in controlPlaneCorsAllowOrigin, or its name ends in a suffix listed in controlPlaneTrustedHostSuffixes. This is so even when controlPlaneCorsAllowOrigin already lists other origins. This is what stops a DNS-rebinding attack from an ordinary malicious web site, which points its own name at MockServer so that its page looks like one MockServer served.

A request to MockServer's own API, or a WebSocket connection, from any other page is refused with 403, whatever its method, before MockServer handles it and before any expectation can answer it; its preflight gets no Access-Control-Allow-* headers. That includes Origin: null, which sandboxed iframes and pages opened from a file send. Tools that are not browsers (curl, the client libraries, your tests' HTTP clients) send no Origin and are not affected.

If a page on another host needs to call MockServer's API, for example a front-end served from https://app.example.com, or the dashboard pointed at a MockServer on another host, set controlPlaneCorsAllowOrigin on that MockServer to the page's origin. The same applies when MockServer sits behind a reverse proxy or Kubernetes ingress that changes the Host header: the dashboard then looks like a page on another host, so set it to the address you open the dashboard at, for example https://mockserver.example.com.

Mocked and proxied responses are separate: they only get CORS headers when enableCORSForAllResponses is on, and then follow corsAllowOrigin, which no longer affects MockServer's own API. A CORS preflight for a request MockServer's own API serves (any /mockserver/... path, or a legacy path such as /reset or /graphql with a method the API serves there) is answered by MockServer under its own rule, not by an expectation. An unmatched preflight for another method on such a legacy path, for example POST /graphql to a mocked GraphQL API, allows only the requested method.

This check stops other web sites using MockServer's API or WebSockets through a visitor's browser, including through DNS rebinding. It does not stop:

an attacker who controls how your machine looks up names (a hostile Wi-Fi network, a spoofing machine on the same local network, or someone who can change your cluster's DNS), who can still rebind any trusted name except an IP address or localhost;
a rebinding attack on a public name you have chosen to trust;
a site visited in a browser that uses MockServer as its proxy, because the page is then same-origin with MockServer.

If any of these applies, for example when you run MockServer on a laptop on public Wi-Fi, or untrusted pages may run in a browser that can reach MockServer, also turn on control-plane authentication.

Answer CORS preflight (OPTIONS) requests that no expectation matches, for every path, using the corsAllowOrigin policy. In practice it is always on once a preflight has been received: the first CORS preflight MockServer answers itself turns it on. MockServer's own API answers preflights under its own rule (see which web pages can use MockServer's own API) whatever this is set to.

Type: boolean Default: false

Java Code:

ConfigurationProperties.enableCORSForAPI(boolean enableCORSForAPI)

System Property:

-Dmockserver.enableCORSForAPI=...

Environment Variable:

MOCKSERVER_ENABLE_CORS_FOR_API=...

Property File:

mockserver.enableCORSForAPI=...

Example:

-Dmockserver.enableCORSForAPI="true"

Enable CORS for mocked and proxied responses, using the corsAllowOrigin policy. MockServer's own API always answers trusted pages, whatever this is set to.

Type: boolean Default: false

Java Code:

ConfigurationProperties.enableCORSForAllResponses(boolean enableCORSForAllResponses)

System Property:

-Dmockserver.enableCORSForAllResponses=...

Environment Variable:

MOCKSERVER_ENABLE_CORS_FOR_ALL_RESPONSES=...

Property File:

mockserver.enableCORSForAllResponses=...

Example:

-Dmockserver.enableCORSForAllResponses="true"

The value used for CORS in the access-control-allow-origin header of mocked and proxied responses (when enableCORSForAllResponses is on). When blank, the request's origin is sent back. It does not affect MockServer's own API, the dashboard or the callback WebSocket; use controlPlaneCorsAllowOrigin for those.

Note: To ensure access-control-allow-credentials works correctly, when corsAllowCredentials is true the CORS header access-control-allow-origin will set its value using the origin header on requests instead of corsAllowOrigin property.

Type: string Default: ""

Java Code:

ConfigurationProperties.corsAllowOrigin(String corsAllowOrigin)

System Property:

-Dmockserver.corsAllowOrigin=...

Environment Variable:

MOCKSERVER_CORS_ALLOW_ORIGIN=...

Property File:

mockserver.corsAllowOrigin=...

Example:

-Dmockserver.corsAllowOrigin="*"

The browser origins allowed to use MockServer's own API (every /mockserver/... path), the dashboard's live log and the callback WebSocket, as a comma-separated list such as https://app.example.com, http://ci-browser:8080. An allowed page gets its origin sent back in access-control-allow-origin; any other page's requests and WebSocket connections are refused with 403, and its preflights get no CORS headers.

When blank (the default), pages on localhost, 127.0.0.1 or [::1] (http or https, any port) are allowed. Pages MockServer serves itself, such as the dashboard, are also allowed when MockServer is reached by localhost, an IP address, a single-word name, a name ending in .svc, .svc.cluster.local or .internal, or a controlPlaneTrustedHostSuffixes entry, whatever this is set to (see controlPlaneTrustedHostSuffixes); to open the dashboard at any other name, list its origin here, for example https://mockserver.example.com. * allows every web site to read from and change MockServer through a visitor's browser, so only use it when nothing sensitive can be reached. See which web pages can use MockServer's own API.

It can only be set when MockServer starts: PUT /mockserver/configuration ignores it and logs a warning, so a request to the control plane cannot widen it.

Type: string Default: ""

Java Code:

ConfigurationProperties.controlPlaneCorsAllowOrigin(String controlPlaneCorsAllowOrigin)

System Property:

-Dmockserver.controlPlaneCorsAllowOrigin=...

Environment Variable:

MOCKSERVER_CONTROL_PLANE_CORS_ALLOW_ORIGIN=...

Property File:

mockserver.controlPlaneCorsAllowOrigin=...

Example:

-Dmockserver.controlPlaneCorsAllowOrigin="https://app.example.com"

Extra host-name endings, as a comma-separated list such as corp.example, k8s.example, at which a page MockServer serves itself, such as the dashboard, may use MockServer's own API and WebSockets. Use it when your Kubernetes cluster uses a custom domain instead of cluster.local, or when you reach MockServer by a private name such as mockserver.corp.example.

Without it, a page MockServer serves is trusted only when MockServer is reached by localhost, an IP address, a single-word name (a Docker, Compose or Kubernetes short service name) or a name ending in .svc, .svc.cluster.local or .internal. A suffix covers names below it (mockserver.corp.example), not the suffix itself; corp.example, .corp.example and *.corp.example mean the same. A public suffix, under which anyone can register a name, such as com, co.uk or github.io, is rejected: it trusts nothing and MockServer logs an error at startup. MockServer also logs a warning for an entry it cannot use. Only list names public DNS cannot resolve: a malicious site that can make a listed name point at MockServer can use MockServer's API through a visitor's browser (DNS rebinding). Even a private name can be rebound by someone who controls your network's name lookups, so use control-plane authentication where that matters.

It can only be set when MockServer starts: PUT /mockserver/configuration ignores it and logs a warning.

Type: string Default: ""

Java Code:

ConfigurationProperties.controlPlaneTrustedHostSuffixes(String controlPlaneTrustedHostSuffixes)

System Property:

-Dmockserver.controlPlaneTrustedHostSuffixes=...

Environment Variable:

MOCKSERVER_CONTROL_PLANE_TRUSTED_HOST_SUFFIXES=...

Property File:

mockserver.controlPlaneTrustedHostSuffixes=...

Example:

-Dmockserver.controlPlaneTrustedHostSuffixes="corp.example"

The value used for CORS in the access-control-allow-methods header.

The property default is blank. When blank, MockServer does not send an empty header; it applies a built-in fallback of CONNECT, DELETE, GET, HEAD, OPTIONS, POST, PUT, PATCH, TRACE so the control-plane API and dashboard work cross-origin out of the box. Set this property only if you need a narrower method list.

Type: string Default: "" (effective default: CONNECT, DELETE, GET, HEAD, OPTIONS, POST, PUT, PATCH, TRACE)

Java Code:

ConfigurationProperties.corsAllowMethods(String corsAllowMethods)

System Property:

-Dmockserver.corsAllowMethods=...

Environment Variable:

MOCKSERVER_CORS_ALLOW_METHODS=...

Property File:

mockserver.corsAllowMethods=...

Example:

-Dmockserver.corsAllowMethods="CONNECT, DELETE, GET, HEAD, OPTIONS, POST, PUT, PATCH, TRACE"

Default value used for CORS in the access-control-allow-headers and access-control-expose-headers headers.

In addition to this default value any headers specified in the request header access-control-request-headers also get added to access-control-allow-headers and access-control-expose-headers headers in a CORS response.

The property default is blank. When blank and the preflight request carries no access-control-request-headers header, MockServer applies a built-in fallback of Allow, Content-Encoding, Content-Length, Content-Type, ETag, Expires, Last-Modified, Location, Server, Vary, Authorization rather than sending an empty header. When blank and the preflight does carry access-control-request-headers, MockServer instead echoes back exactly the headers the browser asked to send. Setting it makes the listed headers always allowed; any headers a preflight requests are still added to them.

Type: string Default: "" (effective default: Allow, Content-Encoding, Content-Length, Content-Type, ETag, Expires, Last-Modified, Location, Server, Vary, Authorization)

Java Code:

ConfigurationProperties.corsAllowHeaders(String corsAllowHeaders)

System Property:

-Dmockserver.corsAllowHeaders=...

Environment Variable:

MOCKSERVER_CORS_ALLOW_HEADERS=...

Property File:

mockserver.corsAllowHeaders=...

Example:

-Dmockserver.corsAllowHeaders="Allow, Content-Encoding, Content-Length, Content-Type, ETag, Expires, Last-Modified, Location, Server, Vary, Authorization"

The value used for CORS in the access-control-allow-credentials header.

Type: boolean Default: false

Java Code:

ConfigurationProperties.corsAllowCredentials(boolean allow)

System Property:

-Dmockserver.corsAllowCredentials=...

Environment Variable:

MOCKSERVER_CORS_ALLOW_CREDENTIALS=...

Property File:

mockserver.corsAllowCredentials=...

Example:

-Dmockserver.corsAllowCredentials="true"

The value, in seconds, used for CORS in the access-control-max-age header, which tells the browser how long it may cache a CORS preflight (OPTIONS) response before sending another one. Raise it to reduce the number of preflight requests a browser-based client sends against a long-running MockServer instance; the default of 0 tells the browser not to cache preflights at all.

Type: int Default: 0

Java Code:

ConfigurationProperties.corsMaxAgeInSeconds(int maxAgeInSeconds)

System Property:

-Dmockserver.corsMaxAgeInSeconds=...

Environment Variable:

MOCKSERVER_CORS_MAX_AGE_IN_SECONDS=...

Property File:

mockserver.corsMaxAgeInSeconds=...

Example:

-Dmockserver.corsMaxAgeInSeconds=300

Examples:

CORS is a server-startup configuration, so it is applied when MockServer starts rather than per-expectation. The examples below launch (or configure) the server with the same CORS settings in each language. The detailed corsAllow* / corsMaxAgeInSeconds values are read once at startup, so set them when the server is launched (the REST API tab can toggle the enable flag at runtime, but does not re-apply the detailed values).

ConfigurationProperties.enableCORSForAllResponses(true);
ConfigurationProperties.corsAllowMethods("CONNECT, DELETE, GET, HEAD, OPTIONS, POST, PUT, PATCH, TRACE");
ConfigurationProperties.corsAllowHeaders("Allow, Content-Encoding, Content-Length, Content-Type, ETag, Expires, Last-Modified, Location, Server, Vary, Authorization");
ConfigurationProperties.corsAllowCredentials(true);
ConfigurationProperties.corsMaxAgeInSeconds(300);

var mockserver = require('mockserver-node');
mockserver.start_mockserver({
    serverPort: 1080,
    systemProperties: "-Dmockserver.enableCORSForAllResponses=true " +
        "-Dmockserver.corsAllowMethods=\"CONNECT, DELETE, GET, HEAD, OPTIONS, POST, PUT, PATCH, TRACE\" " +
        "-Dmockserver.corsAllowHeaders=\"Allow, Content-Encoding, Content-Length, Content-Type, ETag, Expires, Last-Modified, Location, Server, Vary, Authorization\" " +
        "-Dmockserver.corsAllowCredentials=\"true\" " +
        "-Dmockserver.corsMaxAgeInSeconds=\"300\""
});

from mockserver import start_server

# the launcher passes these JVM system properties straight through to the server
server = start_server(port=1080, extra_args=[
    "-Dmockserver.enableCORSForAllResponses=true",
    "-Dmockserver.corsAllowMethods=CONNECT, DELETE, GET, HEAD, OPTIONS, POST, PUT, PATCH, TRACE",
    "-Dmockserver.corsAllowHeaders=Allow, Content-Encoding, Content-Length, Content-Type, ETag, Expires, Last-Modified, Location, Server, Vary, Authorization",
    "-Dmockserver.corsAllowCredentials=true",
    "-Dmockserver.corsMaxAgeInSeconds=300",
])

require 'mockserver-client'

# the launcher passes these JVM system properties straight through to the server
server = MockServer::BinaryLauncher.start(port: 1080, extra_args: [
    '-Dmockserver.enableCORSForAllResponses=true',
    '-Dmockserver.corsAllowMethods=CONNECT, DELETE, GET, HEAD, OPTIONS, POST, PUT, PATCH, TRACE',
    '-Dmockserver.corsAllowHeaders=Allow, Content-Encoding, Content-Length, Content-Type, ETag, Expires, Last-Modified, Location, Server, Vary, Authorization',
    '-Dmockserver.corsAllowCredentials=true',
    '-Dmockserver.corsMaxAgeInSeconds=300'
])

import (
    "os"

    mockserver "github.com/mock-server/mockserver-monorepo/mockserver-client-go/v9"
)

// the launched server inherits these environment variables
os.Setenv("MOCKSERVER_ENABLE_CORS_FOR_ALL_RESPONSES", "true")
os.Setenv("MOCKSERVER_CORS_ALLOW_METHODS", "CONNECT, DELETE, GET, HEAD, OPTIONS, POST, PUT, PATCH, TRACE")
os.Setenv("MOCKSERVER_CORS_ALLOW_HEADERS", "Allow, Content-Encoding, Content-Length, Content-Type, ETag, Expires, Last-Modified, Location, Server, Vary, Authorization")
os.Setenv("MOCKSERVER_CORS_ALLOW_CREDENTIALS", "true")
os.Setenv("MOCKSERVER_CORS_MAX_AGE_IN_SECONDS", "300")

server, _ := mockserver.StartServer(1080, "", nil)

using System;
using MockServer.Client;

// the launched server inherits these environment variables
Environment.SetEnvironmentVariable("MOCKSERVER_ENABLE_CORS_FOR_ALL_RESPONSES", "true");
Environment.SetEnvironmentVariable("MOCKSERVER_CORS_ALLOW_METHODS", "CONNECT, DELETE, GET, HEAD, OPTIONS, POST, PUT, PATCH, TRACE");
Environment.SetEnvironmentVariable("MOCKSERVER_CORS_ALLOW_HEADERS", "Allow, Content-Encoding, Content-Length, Content-Type, ETag, Expires, Last-Modified, Location, Server, Vary, Authorization");
Environment.SetEnvironmentVariable("MOCKSERVER_CORS_ALLOW_CREDENTIALS", "true");
Environment.SetEnvironmentVariable("MOCKSERVER_CORS_MAX_AGE_IN_SECONDS", "300");

var server = MockServerBinaryLauncher.Start(port: 1080);

use mockserver_client::launcher;

// the launched server inherits these environment variables
std::env::set_var("MOCKSERVER_ENABLE_CORS_FOR_ALL_RESPONSES", "true");
std::env::set_var("MOCKSERVER_CORS_ALLOW_METHODS", "CONNECT, DELETE, GET, HEAD, OPTIONS, POST, PUT, PATCH, TRACE");
std::env::set_var("MOCKSERVER_CORS_ALLOW_HEADERS", "Allow, Content-Encoding, Content-Length, Content-Type, ETag, Expires, Last-Modified, Location, Server, Vary, Authorization");
std::env::set_var("MOCKSERVER_CORS_ALLOW_CREDENTIALS", "true");
std::env::set_var("MOCKSERVER_CORS_MAX_AGE_IN_SECONDS", "300");

let server = launcher::start(1080).unwrap();

use MockServer\BinaryLauncher;

// the launcher passes these JVM system properties straight through to the server
$server = (new BinaryLauncher())->start(1080, [
    '-Dmockserver.enableCORSForAllResponses=true',
    '-Dmockserver.corsAllowMethods=CONNECT, DELETE, GET, HEAD, OPTIONS, POST, PUT, PATCH, TRACE',
    '-Dmockserver.corsAllowHeaders=Allow, Content-Encoding, Content-Length, Content-Type, ETag, Expires, Last-Modified, Location, Server, Vary, Authorization',
    '-Dmockserver.corsAllowCredentials=true',
    '-Dmockserver.corsMaxAgeInSeconds=300',
]);

curl -v -X PUT "http://localhost:1080/mockserver/configuration" -d '{
    "enableCORSForAllResponses": true,
    "corsAllowMethods": "CONNECT, DELETE, GET, HEAD, OPTIONS, POST, PUT, PATCH, TRACE",
    "corsAllowHeaders": "Allow, Content-Encoding, Content-Length, Content-Type, ETag, Expires, Last-Modified, Location, Server, Vary, Authorization",
    "corsAllowCredentials": true,
    "corsMaxAgeInSeconds": 300
}'

The enableCORSForAllResponses flag takes effect at runtime; the detailed corsAllow* / corsMaxAgeInSeconds values are only applied when the server starts, so set those at launch (see the other tabs).

java -Dmockserver.enableCORSForAllResponses=true \
-Dmockserver.corsAllowMethods="CONNECT, DELETE, GET, HEAD, OPTIONS, POST, PUT, PATCH, TRACE" \
-Dmockserver.corsAllowHeaders="Allow, Content-Encoding, Content-Length, Content-Type, ETag, Expires, Last-Modified, Location, Server, Vary, Authorization" \
-Dmockserver.corsAllowCredentials="true" \
-Dmockserver.corsMaxAgeInSeconds="300" \
-jar "~/Downloads/mockserver-netty-9.2.0-no-dependencies.jar" -serverPort 1080

The next example answers CORS preflights on every path and sets permissive methods and headers. It does not let another origin use MockServer's own API; for that, also set controlPlaneCorsAllowOrigin to that origin.

ConfigurationProperties.enableCORSForAPI(true);
ConfigurationProperties.corsAllowMethods("CONNECT, DELETE, GET, HEAD, OPTIONS, POST, PUT, PATCH, TRACE");
ConfigurationProperties.corsAllowHeaders("Allow, Content-Encoding, Content-Length, Content-Type, ETag, Expires, Last-Modified, Location, Server, Vary, Authorization");
ConfigurationProperties.corsAllowCredentials(true);
ConfigurationProperties.corsMaxAgeInSeconds(300);

var mockserver = require('mockserver-node');
mockserver.start_mockserver({
    serverPort: 1080,
    systemProperties: "-Dmockserver.enableCORSForAPI=true " +
        "-Dmockserver.corsAllowMethods=\"CONNECT, DELETE, GET, HEAD, OPTIONS, POST, PUT, PATCH, TRACE\" " +
        "-Dmockserver.corsAllowHeaders=\"Allow, Content-Encoding, Content-Length, Content-Type, ETag, Expires, Last-Modified, Location, Server, Vary, Authorization\" " +
        "-Dmockserver.corsAllowCredentials=\"true\" " +
        "-Dmockserver.corsMaxAgeInSeconds=\"300\""
});

from mockserver import start_server

# the launcher passes these JVM system properties straight through to the server
server = start_server(port=1080, extra_args=[
    "-Dmockserver.enableCORSForAPI=true",
    "-Dmockserver.corsAllowMethods=CONNECT, DELETE, GET, HEAD, OPTIONS, POST, PUT, PATCH, TRACE",
    "-Dmockserver.corsAllowHeaders=Allow, Content-Encoding, Content-Length, Content-Type, ETag, Expires, Last-Modified, Location, Server, Vary, Authorization",
    "-Dmockserver.corsAllowCredentials=true",
    "-Dmockserver.corsMaxAgeInSeconds=300",
])

require 'mockserver-client'

# the launcher passes these JVM system properties straight through to the server
server = MockServer::BinaryLauncher.start(port: 1080, extra_args: [
    '-Dmockserver.enableCORSForAPI=true',
    '-Dmockserver.corsAllowMethods=CONNECT, DELETE, GET, HEAD, OPTIONS, POST, PUT, PATCH, TRACE',
    '-Dmockserver.corsAllowHeaders=Allow, Content-Encoding, Content-Length, Content-Type, ETag, Expires, Last-Modified, Location, Server, Vary, Authorization',
    '-Dmockserver.corsAllowCredentials=true',
    '-Dmockserver.corsMaxAgeInSeconds=300'
])

import (
    "os"

    mockserver "github.com/mock-server/mockserver-monorepo/mockserver-client-go/v9"
)

// the launched server inherits these environment variables
os.Setenv("MOCKSERVER_ENABLE_CORS_FOR_API", "true")
os.Setenv("MOCKSERVER_CORS_ALLOW_METHODS", "CONNECT, DELETE, GET, HEAD, OPTIONS, POST, PUT, PATCH, TRACE")
os.Setenv("MOCKSERVER_CORS_ALLOW_HEADERS", "Allow, Content-Encoding, Content-Length, Content-Type, ETag, Expires, Last-Modified, Location, Server, Vary, Authorization")
os.Setenv("MOCKSERVER_CORS_ALLOW_CREDENTIALS", "true")
os.Setenv("MOCKSERVER_CORS_MAX_AGE_IN_SECONDS", "300")

server, _ := mockserver.StartServer(1080, "", nil)

using System;
using MockServer.Client;

// the launched server inherits these environment variables
Environment.SetEnvironmentVariable("MOCKSERVER_ENABLE_CORS_FOR_API", "true");
Environment.SetEnvironmentVariable("MOCKSERVER_CORS_ALLOW_METHODS", "CONNECT, DELETE, GET, HEAD, OPTIONS, POST, PUT, PATCH, TRACE");
Environment.SetEnvironmentVariable("MOCKSERVER_CORS_ALLOW_HEADERS", "Allow, Content-Encoding, Content-Length, Content-Type, ETag, Expires, Last-Modified, Location, Server, Vary, Authorization");
Environment.SetEnvironmentVariable("MOCKSERVER_CORS_ALLOW_CREDENTIALS", "true");
Environment.SetEnvironmentVariable("MOCKSERVER_CORS_MAX_AGE_IN_SECONDS", "300");

var server = MockServerBinaryLauncher.Start(port: 1080);

use mockserver_client::launcher;

// the launched server inherits these environment variables
std::env::set_var("MOCKSERVER_ENABLE_CORS_FOR_API", "true");
std::env::set_var("MOCKSERVER_CORS_ALLOW_METHODS", "CONNECT, DELETE, GET, HEAD, OPTIONS, POST, PUT, PATCH, TRACE");
std::env::set_var("MOCKSERVER_CORS_ALLOW_HEADERS", "Allow, Content-Encoding, Content-Length, Content-Type, ETag, Expires, Last-Modified, Location, Server, Vary, Authorization");
std::env::set_var("MOCKSERVER_CORS_ALLOW_CREDENTIALS", "true");
std::env::set_var("MOCKSERVER_CORS_MAX_AGE_IN_SECONDS", "300");

let server = launcher::start(1080).unwrap();

use MockServer\BinaryLauncher;

// the launcher passes these JVM system properties straight through to the server
$server = (new BinaryLauncher())->start(1080, [
    '-Dmockserver.enableCORSForAPI=true',
    '-Dmockserver.corsAllowMethods=CONNECT, DELETE, GET, HEAD, OPTIONS, POST, PUT, PATCH, TRACE',
    '-Dmockserver.corsAllowHeaders=Allow, Content-Encoding, Content-Length, Content-Type, ETag, Expires, Last-Modified, Location, Server, Vary, Authorization',
    '-Dmockserver.corsAllowCredentials=true',
    '-Dmockserver.corsMaxAgeInSeconds=300',
]);

curl -v -X PUT "http://localhost:1080/mockserver/configuration" -d '{
    "enableCORSForAPI": true,
    "corsAllowMethods": "CONNECT, DELETE, GET, HEAD, OPTIONS, POST, PUT, PATCH, TRACE",
    "corsAllowHeaders": "Allow, Content-Encoding, Content-Length, Content-Type, ETag, Expires, Last-Modified, Location, Server, Vary, Authorization",
    "corsAllowCredentials": true,
    "corsMaxAgeInSeconds": 300
}'

The enableCORSForAPI flag takes effect at runtime; the detailed corsAllow* / corsMaxAgeInSeconds values are only applied when the server starts, so set those at launch (see the other tabs).

java -Dmockserver.enableCORSForAPI=true \
-Dmockserver.corsAllowMethods="CONNECT, DELETE, GET, HEAD, OPTIONS, POST, PUT, PATCH, TRACE" \
-Dmockserver.corsAllowHeaders="Allow, Content-Encoding, Content-Length, Content-Type, ETag, Expires, Last-Modified, Location, Server, Vary, Authorization" \
-Dmockserver.corsAllowCredentials="true" \
-Dmockserver.corsMaxAgeInSeconds="300" \
-jar "~/Downloads/mockserver-netty-9.2.0-no-dependencies.jar" -serverPort 1080

CORS Configuration:

Examples:

See Also