DRUPAL: services.yml

  cors.config:
    enabled: true
    # Specify allowed headers, like 'x-allowed-header','x-csrf-token','authorization','content-type','accept','origin','x-requested-with'.
    allowedHeaders: ['x-csrf-token','content-type', 'authorization']
    # Specify allowed request methods, specify ['*'] to allow all possible ones.
    allowedMethods: ['GET','POST','PATCH','UPDATE','DELETE', 'PUT', 'HEAD', 'OPTIONS', 'TRACE']
    # Configure requests allowed from specific origins.
    allowedOrigins: ['*']
    # Sets the Access-Control-Expose-Headers header.
    exposedHeaders: false
    # Sets the Access-Control-Max-Age header.
    maxAge: false #1000
    # Sets the Access-Control-Allow-Credentials header.
    supportsCredentials: true