Cross-origin resource sharing (CORS) settings

Ory Kratos' Public API supports CORS out of the box. A reference for this configuration can be found in the Configuration Reference.

For CORS to work properly, we encourage to set the following values:

serve:
  public:
    cors:
      enabled: true
      allowed_origins:
        - https://example.org
        - https://*.example.org
      allowed_methods:
        - POST
        - GET
        - PUT
        - PATCH
        - DELETE
      allowed_headers:
        - Authorization
        - Cookie
        - Content-Type
      exposed_headers:
        - Content-Type
        - Set-Cookie

Restricted origins

Use security.restricted_origins for pages that load scripts you don't control, such as ads, but need to know whether the user is signed in. Requests from these origins can only check the session, use FedCM, and log out. All other public endpoints respond with 403 Forbidden, and responses contain only the session ID and whether the session is active. Keep the origin in serve.public.cors.allowed_origins so that the browser can read those responses:

serve:
  public:
    cors:
      enabled: true
      allowed_origins:
        - https://*.example.org
security:
  restricted_origins:
    - https://www.example.org

Each entry is an exact origin without wildcards or paths. Requests without an Origin header, such as calls from your server, still receive full responses. Read Restricted origins for the full list of endpoints and responses.