docs: Reorganize CORS documentation #526
Open
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This change reorganizes some of the guidance in the CORS documentation to provide a more guided approach to developers trying to implement Apollo MCP Server.
✅ Docs preview readyThe preview is ready to be viewed. View the preview File Changes 0 new, 1 changed, 0 removedBuild ID: 8ddf68f1ffd3a2fa8e97fef1 URL: https://www.apollographql.com/docs/deploy-preview/8ddf68f1ffd3a2fa8e97fef1 |
mabuyo
requested changes
Dec 10, 2025
Contributor
mabuyo
left a comment
mabuyo
left a comment
There was a problem hiding this comment.
This is a really great improvement! Had a couple suggestions
|
|
||
| ### Configuring Allowed Origins | ||
|
|
||
| You must specify which browser origins are allowed to access your MCP Server. |
Contributor
There was a problem hiding this comment.
Can we add one more sentence after this just introducing the subheadings below? To signal that there's more than one way to do so.
Wondering if we can also match headings to look like this:
- Why it matters
- Enabling CORS
- Configuring allowed origins
- Allow any origin
- Specific origins
- Match origins
- Passing credentials
- All cors options
- Common configurations
- Development setup
- Production setup
- Public API setup
- Browser integration example
So going up to an H2 for Configuring allowed origins and H3 for subheadings so they show up in the ToC. (I slightly tweaked the heading titles too) What do you think?
| # | ||
| # An origin is a combination of scheme, hostname and port. | ||
| # It does not have any path section, so no trailing slash. | ||
| If you set `allow_any_origin` to `true` (the default is `false`), Apollo MCP Server will respond with `Access-Control-Allow-Origin: *` in all CORS responses. This means that _any_ website can initiate browser connections. It is important to note that your client will not be able to authenticate to your MCP Server if you use this configuration. |
Contributor
There was a problem hiding this comment.
Could we pull out the "it is important to note" to a <Note> component?
| ``` | ||
|
|
||
| You can also disable CORS entirely by setting `enabled` to `false` or omitting the `cors` section: | ||
| Setting `origins` to any list of URLs restricts access to only those specific servers. If you have a known list of web applications accessing your MCP server, you should use this option. An origin is a combination of protocol, hostname, and port. It does not have a path section, so there should be no trailing slash. |
Contributor
There was a problem hiding this comment.
Suggested change
| Setting `origins` to any list of URLs restricts access to only those specific servers. If you have a known list of web applications accessing your MCP server, you should use this option. An origin is a combination of protocol, hostname, and port. It does not have a path section, so there should be no trailing slash. | |
| Set `origins` to a list of URLs to restrict access to specific servers. Use this option if you have a known list of web applications accessing your MCP server. An origin is a combination of protocol, hostname, and port. Origins do not include a path, so do not include a trailing slash. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This change reorganizes some of the guidance in the CORS documentation to provide a more guided approach to developers trying to implement Apollo MCP Server.