Related Documentation
Made by
Kong Inc.
Supported Gateway Topologies
hybrid db-less traditional
Supported Konnect Deployments
hybrid cloud-gateways serverless
Compatible Protocols
grpc grpcs http https
Related Resources

3.11.0.0

Release date 2025/07/03

Bugfix

  • Fixed an issue where requests with empty origin headers would cause empty reply from server.

3.10.0.0

Release date 2025/03/27

Feature

  • Added an option to skip returning the Access-Control-Allow-Origin response header when requests don’t have the Origin header.

3.8.0.0

Release date 2024/09/11

Bugfix

  • Fixed an issue where the Access-Control-Allow-Origin header was not sent when conf.origins has multiple entries but includes *.

3.5.0.0

Release date 2023/11/08

Feature

  • Support the Access-Control-Request-Private-Network header in crossing-origin pre-light requests

3.4.3.5

Release date 2024/03/21

Feature

  • Support the Access-Control-Request-Private-Network header in crossing-origin pre-light requests

3.2.1.0

Release date 2023/02/28

Feature

2.8.0.0

Release date 2022/03/02

Bugfix

  • The CORS plugin does not send the Vary: Origin header anymore when the header Access-Control-Allow-Origin is set to *.

    Thanks, @jkla-dr! #8401

Did this doc help?

Something wrong?

Help us make these docs great!

Kong Developer docs are open source. If you find these useful and want to make them better, contribute today!