CORS Plugin Reference

Field	Type	Default	Optional	Limitations	Description
Access-Control-Allow-Origin	array	["*"]	Yes	1 <= Number of items <= 256.	Allowed origins, format: scheme://host:port, i.e https://somehost.com:8081.
Access-Control-Allow-Headers	array	["*"]	Yes	1 <= Number of items <= 256.	Which headers are allowed to set in request when access cross-origin resource.
Access-Control-Allow-Methods	array	["*"]	Yes	1 <= Number of items <= 9.	Which methods are allowed, i.e. GET, POST.
Access-Control-Expose-Headers	array	["*"]	Yes	1 <= Number of items <= 256.	Which headers are allowed to set in response when access cross-origin resource.
Access-Control-Allow-Credentials	boolean	false	Yes	Other fields cannot be "*" if this option is true	Enable request include credentials (such as Cookie etc.).
Access-Control-Max-Age	integer	5	Yes	-	Maximum number of seconds the results can be cached. Within this time range, the browser will reuse the last check result. -1 means no cache. Please note that the maximum value is depended on browser, please refer to MDN for details.