docs.modx.pro
  1. Extras
  2. MiniShop3
  3. Development
  4. Web API
  5. CORS and rate limit

CORS and rate limit ​

Settings in namespace minishop3: System settings → API.

CORS ​

web.php creates CorsMiddleware with allow_credentials => true. Origins come from ms3_cors_allowed_origins (transport default: empty string).

Setting valueBehavior
emptySame-origin only: no CORS headers
*Access-Control-Allow-Origin: *. Credentials disabled (CorsConfig forces allow_credentials=false)
comma-separated listEcho Origin + Vary: Origin + Allow-Credentials: true

With *, cookies from Nuxt on another origin will not work. Use explicit origins and credentials: 'include' on the client.

Allowed methods: GET, POST, PUT, DELETE, OPTIONS. Headers: Content-Type, Authorization, X-Requested-With, MS3TOKEN. max_age 86400.

Pattern like https://*.example.com matches one DNS label, not arbitrary .*.

OPTIONS preflight returns 200 without token mint.

Rate limit ​

KeyDefaultMeaning
ms3_rate_limit_max_attempts60Requests
ms3_rate_limit_decay_seconds60Window

Exceeded → HTTP 429, error_code rate_limited. See Errors.

Nuxt on another origin ​

  1. List the frontend origin (or BFF) in ms3_cors_allowed_origins.
  2. Requests with credentials: 'include' or Bearer without cookie.
  3. Do not use * together with a cookie session.