grails:
    cors:
        enabled: true8.4 CORS
Version: 3.3.2
8.4 CORS
Spring Boot provides CORS support out of the box, but it is difficult to configure in a Grails application due to the way UrlMappings are used instead of annotations that define URLs. Starting with Grails 3.2.1, we have added a way to configure CORS that makes sense in a Grails application.
Once enabled, the default setting is "wide open".
That will produce a mapping to all urls /** with:
| allowedOrigins | 
 | 
| allowedMethods | 
 | 
| allowedHeaders | 
 | 
| exposedHeaders | 
 | 
| maxAge | 
 | 
| allowCredentials | true | 
Some of these settings come directly from Spring Boot and can change in future versions. See Spring CORS Configuration Documentation
All of those settings can be easily overridden.
grails:
    cors:
        enabled: true
        allowedOrigins:
            - http://localhost:5000In the example above, the allowedOrigins setting will replace [*].
You can also configure different URLs.
grails:
    cors:
        enabled: true
        allowedHeaders:
            - Content-Type
        mappings:
            /api/**:
                allowedOrigins:
                    - http://localhost:5000
                # Other configurations not specified default to the global config| Specifying at least one mapping will disable the creation of the global mapping ( /**). If you wish to keep that setting, you should specify it along with your other mappings. | 
The settings above will produce a single mapping of /api/** with the following settings:
| allowedOrigins | 
 | 
| allowedMethods | 
 | 
| allowedHeaders | 
 | 
| exposedHeaders | 
 | 
| maxAge | 
 | 
| allowCredentials | true | 
If you don’t wish to override any of the default settings, but only want to specify URLs, you can do so like this example:
grails:
    cors:
        enabled: true
        mappings:
            /api/**: inherit