Kong: CORS is a plugin, and letting the upstream also send the headers breaks it

If both Kong and the upstream add Access-Control-Allow-Origin, the browser sees two values in one header and rejects the response outright. The symptom is a CORS error on a request that has CORS configured twice.

Full code & output

This topic is available to PRO members.

Sign in Create a free account

Run this yourself in the Online Java Compiler, spin up a live REST API in the API Sandbox, or practise with Java interview questions.

Published 2026-08-25