Cross-Origin Resource Sharing (CORS) configuration

To access the GraphQL endpoint, a CORS policy must be configured and added to an AEM Project that is deployed to AEM via Cloud Manager. This is done by adding an appropriate OSGi CORS configuration file for the desired endpoint(s). Multiple CORS configurations can be created and deployed to different environments. Examples can be found in the WKND Reference Site

The CORS configuration must specify a trusted website origin alloworigin or alloworiginregexp for which access must be granted.

The configuration file must be named like: com.adobe.granite.cors.impl.CORSPolicyImpl~appname-graphql.cfg.json where appname reflects the name of your application.

For example, to grant access to the GraphQL endpoint /content/cq:graphql/wknd/endpoint and persisted queries endpoint for https://my.domain you can use:

{
  "supportscredentials":false,
  "supportedmethods":[
    "GET",
    "HEAD",
    "POST"
  ],
  "exposedheaders":[
    ""
  ],
  "alloworigin":[
    "https://my.domain"
  ],
  "maxage:Integer":1800,
  "alloworiginregexp":[
    ""
  ],
  "supportedheaders":[
    "Origin",
    "Accept",
    "X-Requested-With",
    "Content-Type",
    "Access-Control-Request-Method",
    "Access-Control-Request-Headers"
  ],
  "allowedpaths":[
    "/content/cq:graphql/wknd/endpoint.json",
    "/graphql/execute.json/.*"
  ]
}

If you have configured a vanity path for the endpoint, you can also use it in allowedpaths.