title: Spring Cloud Gateway with Eureka discovery enable CORS policies
body: <p>I've been searching on how to enable CORS when using Spring Cloud Gateway in addition with Eureka discovery.</p>
  
  <p>My application is up and running and everything works fine. As I work with Eureka discovery I enabled automatic route discovery for Spring Cloud gateway with the following property in application.properties so I don't need to specify the (custom) routing myself.</p>
  
  <blockquote>
    <p>spring.cloud.gateway.discovery.locator.enabled = true</p>
  </blockquote>
  
  <p>I've searched to web to no avail on how to enable CORS, as it is very poorly documented at the moment. The only thing I could find is the following documentation: <a href="https://cloud.spring.io/spring-cloud-gateway/single/spring-cloud-gateway.html#_header_route_predicate_factory" rel="nofollow noreferrer">https://cloud.spring.io/spring-cloud-gateway/single/spring-cloud-gateway.html#_header_route_predicate_factory</a> where it is mentiond in section 5.14 that some default security headers are applied and how to change them.</p>
  
  <p>It says header <i>X-Permitted-Cross-Domain-Policies</i> is default set to <i>none</i> which means CORS is disabled.</p>
  
  <p>The documentation tells me I can change this header by setting property in my application.properties file.</p>
  
  <blockquote>
    <p>spring.cloud.gateway.filter.secure-headers.permitted-cross-domain-policies = ?</p>
  </blockquote>
  
  <p>But I have no idea to what value I need to set this property and it isn't documented anywhere. I have tried setting it to 'any', 'all' and '*' but with no luck.</p>
  
  <p>Can someone help or does anybody know the answer to this? Or if i misinterpreted something please let me know.</p>