{% allow_cors %}

Use this tag to enable Cross-Origin requests for the current page.

Syntax

{% allow_cors [always] %}

Using this tag will always allow cors requests for the current page. If the "always" flag is set, it will allow cors requests for all origins. If the "always" flag is not set, it will only allow cors requests for the current origin (ie: request.headers.origin).

Examples

Allow cross-origin requests from all origins

Copy
{% allow_cors always %}

Allow cross-origin requests from a specific domain

Copy
{% if request.headers.origin == 'https://specifically-allowed-domain.com' %} {% allow_cors %} {% endif %}

Allow cross-origin requests based on custom logic

Copy
{% set is_authorized = false %} {% comment %}custom logic for authorizing the current request{% endcomment %} {% if is_authorized %} {% allow_cors %} {% endif %}