MIP SDK: CORS

{
    ...,
    "CORS": {
        "Enabled": true,
        "Access-Control-Allow-Origin": "yourdomain1.com,yourdomain2.com",
        "Access-Control-Allow-Headers": "Content-Type",
        "Access-Control-Allow-Methods": "*"
    }
}

Only required response headers should be defined. Each response header can have multiple values, provided as a list of comma-separated values.

For development and test purposes, you can use a very permissive policy:

{
    ...,
    "CORS": {
        "Enabled": true,
        "Access-Control-Allow-Origin": "*",
        "Access-Control-Allow-Headers": "*",
        "Access-Control-Allow-Methods": "*"
    }
}

For security reasons, we recommend to always specify the Access-Control-Allow-Origin value with explicit origins. Never use wildcard (*) or null in your origin as this can put the security of your system at risk.