a6-plugin-cors

Configure APISIX CORS policies with origins, methods, headers, and credentials.

1|2|Updated Mar 6, 2026
One-click install
npx skills add https://github.com/api7/a6 --skill a6-plugin-cors-api7
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: a6-plugin-cors
Source: https://github.com/api7/a6/tree/main/skills/a6-plugin-cors
Command: npx skills add https://github.com/api7/a6 --skill a6-plugin-cors-api7

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Cross-origin requests frequently fail due to misconfigured headers and origins. It offers a guided approach to configure and validate the APISIX cors plugin on routes to manage Access-Control-Allow-* headers, origins, methods, and credentials.

Core Features & Use Cases

  • Configure origins, methods, headers, and credentials to support browser-based clients across multiple domains.
  • Use regex patterns to dynamically match origins and enable flexible cross-origin policies.
  • Validate configurations by observing response headers and preflight requests in real-world API usage.

Quick Start

Configure the cors plugin on a route and verify Access-Control headers to confirm proper cross-origin behavior.

Frequently Asked Questions about a6-plugin-cors

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I configure CORS headers for APISIX routes?

Configure the cors plugin on APISIX routes to set allow_origins, allow_methods, allow_headers, max_age, and credentials, ensuring browser-based clients from multiple domains get controlled cross-origin access.

Why does my cross-origin request fail with misconfigured origins on APISIX?

Cross-origin requests fail due to misconfigured Access-Control-Allow-* headers and origins. Applying the APISIX cors plugin validates these headers and origins, confirming proper cross-origin behavior for real-world API usage.

Can I use regex patterns to match multiple origins in APISIX CORS?

Yes, APISIX CORS supports regex patterns to dynamically match origins. This enables flexible cross-origin policies for browser-based clients across multiple domains without hardcoding every single origin.

Does APISIX CORS plugin support credentials for browser-based clients?

Yes, the APISIX CORS plugin supports credentials for browser-based clients. You can configure credentials alongside allow_origins and allow_headers to manage controlled cross-origin access from multiple domains.

What is the best way to validate APISIX CORS preflight requests?

The best way to validate APISIX CORS preflight requests is to observe response headers and preflight requests in real-world API usage after configuring the cors plugin on a route.