# Configurable CORS in router

**URL:** <https://community.apollographql.com/t/configurable-cors-in-router/9554>\
**Category:** Router\
**Tags:** server, router\
**Created:** [November 12, 2025, 5:00pm UTC](https://community.apollographql.com/t/configurable-cors-in-router/9554 "2025-11-12T17:00:37Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![mjfaga](https://sea1.discourse-cdn.com/flex019/user_avatar/community.apollographql.com/mjfaga/32/5533_2.png) [@mjfaga](https://community.apollographql.com/u/mjfaga)\
**Post date:** [November 12, 2025, 5:00pm UTC](https://community.apollographql.com/t/configurable-cors-in-router/9554/1 "2025-11-12T17:00:37Z")

</div>

Hey folks - wondering if I’m missing something in the [CORS config docs](https://www.apollographql.com/docs/graphos/routing/security/cors) or if my very special situation just isn’t supported.

I have to support two pretty different ecosystems:

1. A chrome extension that runs everywhere and needs to support JWT-style auth via an Authentication header
2. A proper application website on a specific domain that uses HTTP-only cookies for auth

For each of these individually, configuring CORS is easy:

1. let it all through  
`cors:`  
` allow_any_origin: true`
2. a bit more config:  
`cors:`  
` policies:`  
` - origins: `  
` - https://www.your-app.example.com`  
` allow_credentials: true`

However, I can’t do one OR the other. Is this not supported at all, or would I need to pass an empty array to policies and then handle in a rhai script? The only other alternative I can think of would be to deploy separate router infra and hit a separate endpoint based on CX vs. the app.

Open to other thoughts/ideas!

---

<div class="post-metadata">

**Author:** ![mjfaga](https://sea1.discourse-cdn.com/flex019/user_avatar/community.apollographql.com/mjfaga/32/5533_2.png) [@mjfaga](https://community.apollographql.com/u/mjfaga)\
**Post date:** [January 9, 2026, 7:50pm UTC](https://community.apollographql.com/t/configurable-cors-in-router/9554/2 "2026-01-09T19:50:24Z")

</div>

Just bumping this one to see if anyone has thoughts please.