anchor.diff:              "pathPattern": "/other/path/.*"
           }
       ]
  -}```
  -
  +}
  +```
   
   ==== CORS Policy
   [[policy-cors]]
   ===== Description
  +A policy implementing CORS (Cross-origin resource sharing): a method of defining access to resources outside of the originating domain. It is principally a security mechanism to prevent the loading of resources from unexpected domains, for instance via XSS injection attacks.
  +
  +For further references, see http://www.w3.org/TR/2014/REC-cors-20140116/[CORS W3C Recommendation 16 January 2014] and https://developer.mozilla.org/en-US/docs/Web/HTTP/Access_control_CORS#Access-Control-Allow-Origin[MDN's articles].
  +
  +===== Plugin
  +
  +```json
  +{
  +    "groupId": "io.apiman.plugins",
  +    "artifactId": "apiman-plugins-cors-policy",
  +    "version": "1.2.5.Final" <1>
  +}
  +```
  +<1> Please check for the latest version, this is just an example.
  +
  +===== Configuration
  +The configuration options available, are:
  +
  +[cols="2,1,4,1", options="header"]
  +|===
  +| Option
  +| Type
  +| Description
  +| Default
  +
  +| errorOnCorsFailure
  +| Boolean
  +| When true, any request that fails CORS validation will be terminated with an appropriate error. When false, the request will still be sent to the backend API, but the browser will be left to enforce the CORS failure. In both cases valid CORS headers will be set
  +| true
  +
  +| allowOrigin (Access-Control-Allow-Origin)
  +| Set<String>
  +| List of origins permitted to make CORS requests through the gateway. By default same-origin is permitted, and cross-origin is forbidden. An entry of * permits all CORS requests
  +| Empty
  +
  +| allowCredentials (Access-Control-Allow-Credentials)
  +| Boolean
  +| Whether response may be exposed when the `credentials` flag is set to true on the request
  +| false
  +
  +| exposeHeaders (Access-Control-Expose-Headers)
  +| Set<String>
  +| Which non-simple headers the browser may expose during CORS
  +| Empty
  +
  +| allowHeaders (Access-Control-Allow-Headers)
  +| Set<String>
  +| In response to preflight request, which _headers_ can be used during actual request
  +| Empty
  +
  +| allowMethods (Access-Control-Allow-Methods)
  +| Set<String>
  +| In response to preflight request, which _methods_ can be used during actual request
  +| Empty
  +
  +| maxAge (Access-Control-Max-Age)
  +| Integer
  +| How long preflight request can be cached in delta seconds
  +| Not included
  +|===
  +
  +===== Sample Configuration
  +
  +```json
  +{
  +   "exposeHeaders" : [
  +      "X-REQUESTS-REMAINING"
  +   ],
  +   "maxAge" : 9001,
  +   "allowOrigin" : [
  +      "https://foo.example",
  +      "https://bar.example"
  +   ],
  +   "errorOnCorsFailure" : true,
  +   "allowCredentials" : false,
  +   "allowMethods" : [
  +      "POST"
  +   ],
  +   "allowHeaders" : [
  +      "X-CUSTOM-HEADER"
  +   ]
  +}
  +```
  +
  +==== HTTP Security Policy
  +[[policy-http-security]]
  +===== Description
  +Security-related HTTP headers can be set, such as HSTS, CSP and XSS protection.
  +
  +===== Plugin
  +
  +```json
  +{
  +    "groupId": "io.apiman.plugins",
  +    "artifactId": "apiman-plugins-http-security-polic",
  +    "version": "1.2.5.Final" <1>
  +}
  +```
  +<1> Please check for the latest version, this is just an example.
  +
  +===== Configuration
  +
  +Options for `hsts` are:
  +
  +[cols="2,1,4,1", options="header"]
  +.HTTP Strict Transport Security (hsts): Enforce transport security when using HTTP to mitigate a range of common web vulnerabilities.
  +|===
  +| Option
  +| Type
  +| Description
  +| Default
  +
  +| enabled
  +| Boolean
  +| Enable HTTP Strict Transport (HSTS)
  +| false
  +
  +| includeSubdomains
  +| Boolean
  +| Include subdomains
  +| false
  +
  +| maxAge
  +| Integer
  +| Delta seconds user agents should cache HSTS status for
  +| 0
  +
  +| preload (Enable HSTS preload flag)
  +| Boolean
  +| Flag to verify HSTS preload status. Popular browsers contain a hard-coded (pinned) list of domains and certificates, which they always connect securely with. This mitigates a wide range of identity and MIITM attacks, and is particularly useful for high-profile domains. Users must submit a request for their domain to be included in the scheme.
  +| false
  +|===
  +
  +Options for `contentSecurityPolicy` are:
  +
  +[cols="2,1,4,1", options="header"]
  +.CSP (contentSecurityPolicy): A sophisticated mechanism to precisely define the types and sources of content that may be loaded, with violation reporting and the ability to restrict the availability and scope of many security-sensitive features
  +|===
  +
  +| Option
  +| Type
  +| Description
  +| Default
  +
  +| mode (CSP Mode)
  +| Enum [ENABLED, REPORT_ONLY, DISABLED]
  +| Which content security policy mode to use.
  +| DISABLED
  +
  +| csp (Content Security Policy Definition)
  +| String
  +| A valid CSP definition to apply
  +| Empty string
  +
  +|===
  +
  +[cols="2,1,4,1", options="header"]
  +.Other Configuration Options
  +|===
  +
  +| Option
  +| Type
  +| Description
  +| Default
  +
  +| frameOptions (Frame Options)
  +| Enum [DENY, SAMEORIGIN, DISABLED]
  +| Defines if, or how, a resource should be displayed in a frame, iframe or object.
  +| DISABLED
  +
  +| xssProtection (XSS Protection)
  +| Enum [OFF, ON, BLOCK, DISABLED]
  +| Enable or disable XSS filtering in the UA.
  +| DISABLED
  +
  +| contentTypeOptions
  +| Boolean
  +| X-Content-Type-Options: Prevent MIME-sniffing to any type other than the declared Content-Type.
  +| false
  +
  +|===
  +
  +===== Sample Configuration
  +
  +```json
  +{
  +   "contentSecurityPolicy" : {
  +      "mode" : "REPORT_ONLY",
  +      "csp" : "default-src none; script-src self; connect-src self; img-src self; style-src self;"
  +   },
  +   "frameOptions" : "SAMEORIGIN",
  +   "contentTypeOptions" : true,
  +   "hsts" : {
  +      "includeSubdomains" : true,
  +      "preload" : false,
  +      "enabled" : true,
  +      "maxAge" : 9001
  +   },
  +   "xssProtection" : "ON"
  +}
  +```
  +
  +==== OAuth Policy (Keycloak)
  +[[policy-keycloak-oauth]]
  +===== Description
   DESCRIPTION TBD HERE
   
   ===== Plugin
  
positive.code: ===== Sample Configuration (JDBC)
  Here is an example of the JSON configuration you might use when configuring a
  BASIC Authentication policy that uses JDBC to validate the inbound credentials:
  ```json
  {
     "realm" : "Example",
  
negative.code: 
  [width="75%",options="header"]
  |==========================
  | This Path                      | Results in these Resources Being Ignored
  | (empty)                        | Access to all resources is allowed
  | /customers                     | Denies access to all customer information
  | /customers/.*/orders           | Denies access to all customer order information
  