a6-plugin-cors

Configure APISIX CORS policies with origins, methods, headers, and credentials.

1|2|Updated Mar 6, 2026
One-click install
npx skills add https://github.com/api7/a6 --skill a6-plugin-cors-api7
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: a6-plugin-cors
Source: https://github.com/api7/a6/tree/main/skills/a6-plugin-cors
Command: npx skills add https://github.com/api7/a6 --skill a6-plugin-cors-api7

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Cross-origin requests frequently fail due to misconfigured headers and origins. It offers a guided approach to configure and validate the APISIX cors plugin on routes to manage Access-Control-Allow-* headers, origins, methods, and credentials.

Core Features & Use Cases

  • Configure origins, methods, headers, and credentials to support browser-based clients across multiple domains.
  • Use regex patterns to dynamically match origins and enable flexible cross-origin policies.
  • Validate configurations by observing response headers and preflight requests in real-world API usage.

Quick Start

Configure the cors plugin on a route and verify Access-Control headers to confirm proper cross-origin behavior.

Frequently Asked Questions about a6-plugin-cors

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I configure CORS headers for APISIX routes?▼

Configure the cors plugin on APISIX routes to set allow_origins, allow_methods, allow_headers, max_age, and credentials, ensuring browser-based clients from multiple domains get controlled cross-origin access.

Why does my cross-origin request fail with misconfigured origins on APISIX?▼

Cross-origin requests fail due to misconfigured Access-Control-Allow-* headers and origins. Applying the APISIX cors plugin validates these headers and origins, confirming proper cross-origin behavior for real-world API usage.

Can I use regex patterns to match multiple origins in APISIX CORS?▼

Yes, APISIX CORS supports regex patterns to dynamically match origins. This enables flexible cross-origin policies for browser-based clients across multiple domains without hardcoding every single origin.

Does APISIX CORS plugin support credentials for browser-based clients?▼

Yes, the APISIX CORS plugin supports credentials for browser-based clients. You can configure credentials alongside allow_origins and allow_headers to manage controlled cross-origin access from multiple domains.

What is the best way to validate APISIX CORS preflight requests?▼

The best way to validate APISIX CORS preflight requests is to observe response headers and preflight requests in real-world API usage after configuring the cors plugin on a route.