Configuration options
Contents
The following configuration options are available for Guillotine
Config file
To configure Guillotine, add a configuration file to your XP instance’s config folder.
com.enonic.app.guillotine.cfg
graphql.extensions.modifyUnknownField=throw (1)
cors.origin= https://example.com, https://admin.example.com (2)
cors.credentials=true|false (3)
cors.allowedHeaders=Content-Type (4)
cors.methods=POST, OPTIONS (5)
cors.exposedHeaders = X-Request-Id, X-Custom-Header (6)
cors.maxAge= 3600 (7)
maxQueryTokens=15000 (8)| 1 | Allows you to modify the default behaviour during modification of unknown fields. Possible values are: throw - to throw an error if it tries to modify an unknown field, ignore - to ignore modification modify an unknown field, or warn - to log a warning on unknown field modification. Default is throw. |
| 2 | Allowed origin(s), comma-separated. Omit this field to disable CORS. Supports ~-prefixed regex patterns for dynamic matching (e.g. ~https://.\.example\.com). Can use ~.* to reflect all. |
| 3 | Sets the Access-Control-Allow-Credentials header to allow credentials in CORS requests. Default is false. |
| 4 | Sets the Access-Control-Allow-Headers header to allow headers in CORS requests. If cors.allowedHeaders is not configured and a request includes Access-Control-Request-Headers, that value is reflected in Access-Control-Allow-Headers. |
| 5 | Sets the Access-Control-Allow-Methods header to allow methods in CORS requests. Guillotine handlers only POST and OPTIONS. Default is GET, HEAD, POST. |
| 6 | Extra response headers to expose beyond the CORS safelist. If you configure cors.exposedHeaders = , browsers only treat |
| 7 | Sets the Access-Control-Max-Age header to specify preflight cache duration in seconds |
| 8 | If the number of raw tokens exceeds the specified maximum, the parser will throw an exception. Default is 15000. |
A default base URL for media URLs can be configured on XP itself with the media.defaultBaseUrl option in com.enonic.xp.portal.cfg. |