How do I enable CORS on Service endpoint?

Question

I tried to call a Drupal service endpoint, exposed by the Services module, using ionic which is built on Cordova. I ran 'ionic serve', so it wasn't serving from the file system but had an actual localhost and port url. I then installed the CORS module and I'm a bit confused by what I need to include. My endpoint is http://example.com/api/v1/ It is a REST based server and I only enabled JSON.
I want to get data from the site to load into a mobile app - such as an Android - a hybrid app (meaning coded in HTML/JS and packaged with ionic).

The documentation is a bit confusing to me. It reads

"A list of paths and corresponding domains to enable for CORS. Multiple entries should be separated by a comma. Enter one value per line separated by a pipe, in this order:"

Internal path

Access-Control-Allow-Origin. Use to echo back the Origin header.

Access-Control-Allow-Methods

Access-Control-Allow-Headers

Access-Control-Allow-Credentials

Examples:

*|http://example.com

api|http://example.com:8080 http://example.com

api/*|<mirror>,https://example.com

api/*|<mirror>|POST|Content-Type,Authorization|true

Do I include Access-Control-Allow-Origin|api/*|http://example.com, or is the domain supposed to represent the domain that can call my service?

Maybe I just need Internal Path and not anything else. None of the examples uses Access-Control-All-*. I don't plan to do more than GET requests at this time.

Answer 1

If your endpoint is "your.host/api/v1/" this minimal CORS module configuration should work for anonymous GET requests:

api/v1/*|<mirror>

Answer 2

I had to enable headers on my ubuntu server: sudo a2enmod headers

Also, for the CORS settings I used: *|http://myappURL-that-gets-data-from-drupal

Answer 3

I advice you to use oauth2 server which provides an oauth2 server used to authenticate rest requests so your endpoint would process requests that have authorization header.

Implement the Client credentials to support the apps (mobile apps/angular clients) with keys used to get access token so that no other app will take any information from your endpoint except having those keys.

by that way you authenticate the source of the request so you are in no need for other modules.