cors.yaml

        enable: 
          type: boolean
          description: Enable or disable CORS middleware
          example: true
              
        allowed_origins: 
          type: array
          description: A list of origin domains to allow access from
          example: ["foo.com", "bar.com"]
          
        allow_credentials:
          type: boolean
          description: Allow credentials (cookies)
          example: true
          
        allowed_headers: 
          type: array 
          description: Headers to allow in the request
          
        allowed_methods:
          type: array
          description: Allowed methods
          example: ["GET", "POST", "DELETE"]
          
        exposed_headers:
          type: array
          description: Whitelist of headers to expose in the response
          
        max_age: 
          type: integer
          description: Maximum age of credentials in hours
          example: 24
          
        options_passthrough: 
          type: boolean
          description: Allow CORS OPTIONS preflight request to be proxied directly to upstream, without authentication and rest of checks. This means that pre-flight requests generated by web-clients such as SwaggerUI or the Tyk Portal documentation system will be able to test the API using trial keys. If your service handles CORS natively, then enable this option.
          
        debug: 
          type: boolean
          default: false
          example: true
          description: enabling produces log output from the CORS middleware