title: WSO2 API Manager CORS
body: <p>I'd like to enable CORS on my WSO2 API Manager instance for all endpoints. 
  I've been through the documentation (which is great) and it suggests altering the <strong><em>repository/conf/api-manager.xml</em></strong> file as there is a CORS configuration node within it (below). </p>
  
  <pre><code>&lt;!--Configuration to enable/disable sending CORS headers in the Gateway response
      and define the Access-Control-Allow-Origin header value.--&gt;
  &lt;CORSConfiguration&gt;
  
      &lt;!--Configuration to enable/disable sending CORS headers from the Gateway--&gt;
      &lt;Enabled&gt;true&lt;/Enabled&gt;
  
      &lt;!--The value of the Access-Control-Allow-Origin header. Default values are
          API Store addresses, which is needed for swagger to function.--&gt;
      &lt;Access-Control-Allow-Origin&gt;*&lt;/Access-Control-Allow-Origin&gt;
  
      &lt;!--Configure Access-Control-Allow-Methods--&gt;
      &lt;Access-Control-Allow-Methods&gt;GET,PUT,POST,DELETE,PATCH,OPTIONS&lt;/Access-Control-Allow-Methods&gt;
  
      &lt;!--Configure Access-Control-Allow-Headers--&gt;
      &lt;Access-Control-Allow-Headers&gt;authorization,Access-Control-Allow-Origin,Content-Type&lt;/Access-Control-Allow-Headers&gt;
  
  &lt;!--Configure Access-Control-Allow-Credentials--&gt;
  &lt;!-- Specifying this header to true means that the server allows cookies (or other user credentials) to be included on cross-origin requests.
       It is false by default and if you set it to true then make sure that the Access-Control-Allow-Origin header does not contain the wildcard (*)
  --&gt;
  &lt;Access-Control-Allow-Credentials&gt;true&lt;/Access-Control-Allow-Credentials&gt;
  
  &lt;/CORSConfiguration&gt;
  </code></pre>
  
  <p>This file doesn't seem to apply this CORS configuration to all endpoints though. I receive the correct Access Control headers when making requests to API endpoints that I've published but I don't receive them when I hit the token endpoints (default - '/token', '/revoke').</p>
  
  <p>How am I able to achieve this?</p>