Configuring CORS for WebSphere Application Server

## 0. Enable the mod_headers module
# Find a line resembling "LoadModule headers_module modules/mod_headers.so" in httpd.conf
# If it's commented, remove the leading '#'. If it's entirely absent, append it to httpd.conf

## 1. Basic Example

# To allow any origin to access API's hosted behind this webserver
Header always set Access-Control-Allow-Origin "*"
# Override any value sent by the backend application. 
Header onsuccess unset Access-Control-Allow-origin

# Avoid passing OPTIONS back to WebSphere in case WAS would redirect or return an error
# Note: This assumes the application does not use OPTIONS other than CORS pre-flight requests
SetEnvIfNoCase REQUEST_METHOD OPTIONS skipwas=1
 
## 2. Additional Examples (pick one)

# 2.1 To allow ONLY origin.example.com to access API's hosted behind this webserver
Header always set Access-Control-Allow-Origin "origin.example.com"

# 2.2 To allow any origin from a list of acceptable origins:
SetEnvIfNoCase Origin "https?://(origin1.example.com|origin2.example.com)(:\d+)?$" ACAO=$0
Header onsuccess unset Access-Control-Allow-origin env=ACAO
Header always set Access-Control-Allow-Origin "%{ACAO}e" env=ACAO
Header always append Vary "Origin"
SetEnvIfNoCase REQUEST_METHOD OPTIONS skipwas=1


# 2.3 To restrict the CORS configuration to a specific URL or context root, surround any of the above 
# with the <Location> directive
<Location /my-service>
    Header always set Access-Control-Allow-Origin "*"
    # Or one of the more involved examples   
</Location>

<cors domain="/my-service"
    allowedOrigins="https://origin1.example.com,https://origin2.example.com"
    allowedMethods="GET"
    allowCredentials="true"
    exposeHeaders="MyHeader"/>