mirror of
https://github.com/elastic/elasticsearch.git
synced 2025-04-25 07:37:19 -04:00
Today, we disable CORS by default, but if a user simply enables CORS their instance of elasticsearch will allow cross origin requests from anywhere, as the default value for allowed origins is `*`. This changes the default to be `null` so that no origins are allowed and the user must explicitly specify the origins they wish to allow requests from. The documentation also mentions that there is a security risk in using `*` as the value. Closes #11169 |
||
---|---|---|
.. | ||
cluster | ||
discovery | ||
indices | ||
advanced-scripting.asciidoc | ||
cluster.asciidoc | ||
discovery.asciidoc | ||
gateway.asciidoc | ||
http.asciidoc | ||
indices.asciidoc | ||
memcached.asciidoc | ||
network.asciidoc | ||
node.asciidoc | ||
plugins.asciidoc | ||
scripting.asciidoc | ||
snapshots.asciidoc | ||
threadpool.asciidoc | ||
thrift.asciidoc | ||
transport.asciidoc | ||
tribe.asciidoc |