--- schema_version: "1" id: ad5e400cb7db2ef0f659e4f512c735b23e368117d73c375540a9814332b7dc13 title: Cross-Origin Resource Sharing collection: mulesoft version: current locale: ja-jp portal_url: https://docs.salesforce.com/mulesoft/current/ja-jp/release-notes/policies/cors-policy-release-notes.md canonical_url: https://docs.mulesoft.com/jp/release-notes/policies/cors-policy-release-notes source_site: docs.mulesoft.com content_type: documentation content_hash: cf9f513f5d535752dd20d1495767ced61ad8fcbeb07b1ad640672b6b1a3b7430 description: MuleSoft Documentation Site latest: true --- # Cross-Origin Resource Sharing ## [](#1-3-3)1.3.3 **October 1, 2026** ### What’s New - This release updates policy metadata only. There’s no functional change. ## [](#1-2-2)1.2.2 **April 4, 2023** ### [](#minimum-mule-version)Minimum Mule Version **Mule 4.1.0** ### [](#fixed-issues)Fixed issues - Request payloads are no longer returned in the response when the policy is applied with specific origins and a request is performed with an unknown origin. ## [](#1-2-1)1.2.1 **June 6, 2022** ### [](#minimum-mule-version-2)Minimum Mule Version **Mule 4.1.0** ### [](#fixed-issues-2)Fixed issues When policy is configured with a wildcard origin (`*`) and allowing credentials, the Origin returned is the wildcard itself, and not the request’s origin as stated by the CORS specification. ## [](#1-3-1)1.3.1 **June 1, 2022** ### [](#fixed-issues-3)Fixed issues - Fix policy schema not allowing additional properties via REST API. ## [](#1-3-0)1.3.0 **May 17, 2022** ### [](#new-features-and-enhancements)New Features and Enhancements - First Flex compatible Policy. - Separated Policy Definition from Policy Implementation. Stronger validations applied to a given policy configuration. ## [](#1-2-0)1.2.0 **October 8, 2020** ### [](#minimum-mule-version-3)Minimum Mule Version **Mule 4.1.0** ### [](#fixed-issues-4)Fixed issues The policy deployment fails when the CORS policy is applied to an API whose HTTP Listener configuration is deployed in a Mule domain, and that API uses Mule runtime engine v4.1.x. This is because both the domain and the policy export the same internal package. ### [](#new-features-and-enhancements-2)New Features and Enhancements - The CORS policy now supports an **value in the `Origins` and `Headers` fields. An** signifies that there are no restrictions in the origin and header fields of the API request. ## [](#1-1-5)1.1.5 **July 8, 2020** ### [](#minimum-mule-version-4)Minimum Mule Version **Mule 4.1.0** ### [](#fixed-issues-5)Fixed issues - When the CORS Policy is applied to an API whose HTTP Listener configuration is in a Mule Domain, the policy deployment fails. This is because both the domain and the policy export the same internal package. ## [](#1-1-4)1.1.4 **Apr 30, 2020** ### [](#minimum-mule-version-5)Minimum Mule Version **Mule 4.1.0** ### [](#new-features-and-enhancements-3)New Features and Enhancements - The CORS policy business logic is now completely modified to improve performance. - Several performance improvements are made to the header manipulation engine. ### [](#fixed-issues-6)Fixed issues - After a policy was applied, HTTP headers did not follow the RFC 2616 requirement of case-sensitivity: [https://www.w3.org/Protocols/rfc2616/rfc2616-sec4.html#sec4.2](https://www.w3.org/Protocols/rfc2616/rfc2616-sec4.html#sec4.2). ## [](#1-1-3)1.1.3 **Jul 12, 2019** ### [](#minimum-mule-version-6)Minimum Mule Version **Mule 4.1.0** ### [](#new-features-and-enhancements-4)New Features and Enhancements - Several performance improvements were introduced in this release. ### [](#fixed-issues-7)Fixed Issues - CORS policy does not try to duplicate Access-Controll-Allow-Origin header anymore. - CORS policy now only returns HTTP method selected as allowed in the Access-Control-Allow-Methods header. ## [](#1-1-2)1.1.2 **Apr 26, 2019** ### [](#minimum-mule-version-7)Minimum Mule Version **Mule 4.1.0** ### [](#new-features-and-enhancements-5)New Features and Enhancements - Several performance improvements were introduced in this release. ## [](#1-1-1)1.1.1 **Dec 05, 2018** ### [](#minimum-mule-version-8)Minimum Mule Version **Mule 4.1.0** ### [](#new-features-and-enhancements-6)New Features and Enhancements - No new features were added in this version. ### [](#fixed-issues-8)Fixed Issues - The CORS Policy does not throw a 500 Server Error anymore if the content-type is not specified in the request. ## [](#1-1-0)1.1.0 **Jun 25, 2018** ### [](#minimum-mule-version-9)Minimum Mule Version **4.0.0** ### [](#new-features-and-enhancements-7)New Features and Enhancements - Reduced error-handling verbosity in templates. - The transformations of HTTP attributes are now based on a specified output type. ### [](#fixed-issues-9)Fixed Issues - Fixed missing groupId for proxy samples dependency. ## [](#1-0-0)1.0.0 **Nov 14, 2017** ### [](#minimum-mule-version-10)Minimum Mule Version **4.0.0** ## [](#see-also)See Also - [CORS Policy for Mule 4](https://docs.mulesoft.com/gateway/latest/policies-included-cors) - [Known Issues](https://help.salesforce.com/s/issues)