Kong: CORS is a plugin, and letting the upstream also send the headers breaks it

If both Kong and the upstream add Access-Control-Allow-Origin, the browser sees two values in one header and rejects the response outright. The symptom is a CORS error on a request that has CORS configured twice.

• Kong: a custom plugin's shared state is per worker, not per node
• Kong: the default upstream timeouts are 60 seconds each
• Kong: DB-less mode has no Admin API writes, by design
• Kong: a consumer-scoped plugin only runs after an auth plugin identified the consumer
• Kong: passive health checks never bring a target back
• Kong: strip_path decides what path the upstream actually receives

---

Run this yourself in the Online Java Compiler, spin up a live REST API in the API Sandbox, or practise with Java interview questions.

Published 2026-08-25

© Java Coding Hub · About · Contact · Privacy · Terms