01
Allow the storefronts you intend
Configure the origins and request settings your GraphQL and REST clients need. Handle OPTIONS preflight requests and the actual response policy together.
Magento 2.4.9
Headless Ready
Astro Storefront Required
INCLUDED IN AGENTICSUITE
Astro CORS for Headless Magento
Connect your decoupled storefront to Magento with an explicit cross-origin policy. Control allowed origins, methods and headers for GraphQL and REST.
Part of the complete platform.
This capability is included in AgenticSuite. Get the Astro storefront and all headless and Luma-compatible modules listed on this website.
Explore AgenticSuite Discuss your Magento projectYour platform. Your control.Full source code and your business data.
Built to work togetherAstro storefront and comprehensive Magento modules.
Check your requirements with us - Configurable origin, method and header policy
- Preflight and actual-response headers
- Optional backend storefront redirection
BUILT AROUND THE WAY YOU WORK
A clear boundary between storefront and backend.
Included in AgenticSuite. This is part of a headless Magento implementation; the storefront and deployment must be configured to use it.
02
Keep backend access purposeful
Optional redirection can move remaining Luma storefront visits to your decoupled frontend while leaving Admin, APIs and media/static available.
A CLEAR WORKFLOW
From setup to everyday use.
- 01
Explore AgenticSuite and the live storefronts to see how the parts fit together.
- 02
Discuss your current Magento setup, integrations and requirements with our team.
- 03
Configure and test this capability as part of the agreed storefront project.
Do I need to buy this capability separately?+
AgenticSuite includes the Astro storefront and all headless and Luma-compatible modules listed on this website. Discuss the complete platform and your implementation scope with us.
Can you migrate my current store while it remains live?+
We can prepare and test a new storefront while the existing store keeps trading. Product, CMS and compatible module-data migration, final data synchronisation and cutover are planned for your specific project.
Does the licence include hosting and a bespoke build?+
Hosting, migration, training and custom development are agreed separately. We can discuss Cloudways for Magento and Cloudflare for the frontend; you can pay the providers directly or request a managed quotation.
Latest release: Version 1.0.4
Astro CORS is a Magento 2 module that gives a headless storefront correct, secure cross-origin access to Magento’s GraphQL and REST APIs, with per-origin allow-lists, spec-safe wildcard and credentials handling, and fast OPTIONS preflight short-circuiting.
Going headless? The browser will block you before you ship a single page
The moment your Astro storefront calls Magento's GraphQL from a different domain, the browser's same-origin policy steps in — and unless the backend answers preflight requests and returns the right CORS headers, every request fails with a console error that has nothing to do with your code. Magento doesn't ship a CORS layer. Astro CORS adds one: a policy you control over GraphQL and REST, correct preflight handling, and a clean way to retire the old Luma storefront, so the decoupled build just works.
GraphQL + REST CORS · Correct preflight · Headers on real responses · Origin allow-list · Luma → frontend redirect · Callback-safe · Check release-specific Magento and PHP compatibility
| A policy you control | Set the allowed origins, methods and headers for GraphQL and REST — name your storefronts, or use a wildcard for development. |
|---|---|
| Preflight done right | OPTIONS preflight requests are answered correctly, so the browser proceeds instead of blocking the real call. |
| Headers where they count | CORS headers are added to the actual GraphQL responses, not only the preflight — the gap that breaks many setups. |
| Retire the old storefront | Redirect the backend's leftover Luma pages to your Astro frontend, while keeping APIs, admin and assets working. |
What you'll use it for
- Connect Astro to Magento — let a storefront on its own domain call GraphQL and REST without the browser blocking it.
- Support multiple environments — allow
localhostfor development and your live domains for production from one list. - Tidy up the backend — 301-redirect any leaked Luma URL to the matching page on your headless frontend, good for SEO.
- Keep callbacks alive — exempt OAuth and payment-return paths so they keep working on the backend host.
How it works
Secure by default, not wide open
A CORS layer is only useful if it's also safe. You name the exact origins your storefronts run on, rather than leaving the door open — and when a wildcard is used, credentials are handled correctly so the policy never quietly becomes insecure. The redirect that retires the old Luma storefront only touches browseable pages: GraphQL, REST, the admin and your /media and /static assets are never redirected, and you keep an allow-list of front names (like OAuth callbacks and payment returns) that must continue to work on the backend host.
Specifications
| CORS scope | GraphQL and REST, with configurable allowed origins, methods and headers |
|---|---|
| Preflight | Correct handling of OPTIONS preflight requests |
| Responses | CORS headers applied to actual API responses, not only preflight |
| Wildcard safety | Credentials handled correctly when a wildcard origin is used |
| Headless redirect | Optional 301/302 redirect of Luma storefront pages to your frontend |
| Exemptions | Allow-list of front names kept on the backend (OAuth callbacks, payment returns); APIs, admin and assets never redirected |
| Delivery & licence | Composer install, per-domain licence key, updates via Composer |
Works with
Part of the AgenticEcom suite for Headless & Astro:
Foundational for any headless build; pairs with Astro ISR for cache freshness. Included in the AgenticEcom Suite.
Frequently asked questions
Why do I need a CORS module for headless Magento?
When your storefront runs on a different domain from Magento, the browser blocks cross-origin API calls unless the backend answers preflight requests and returns the right CORS headers. Magento has no built-in CORS layer, so those calls fail until you add one.
Can I restrict which sites can call my API?
Yes. You list the exact origins allowed to call GraphQL and REST, along with the permitted methods and headers. A wildcard is available for development, with credentials handled safely.
What is the Luma-to-frontend redirect for?
After going headless, the Magento backend still serves its old storefront pages. The optional redirect sends those URLs to the matching page on your Astro frontend — without ever redirecting GraphQL, REST, the admin or your media and static assets.
Will it break my OAuth or payment callbacks?
No. You keep an allow-list of front names that must stay on the backend, such as social-login and payment-return URLs, so those continue to work even with the redirect enabled.
Which Magento and PHP versions are supported?
Check release-specific Magento and PHP compatibility before installation.
SEE THE WHOLE PLATFORM
The capability is one part. AgenticSuite brings it together.
Keep Magento as your commerce engine. Shape the customer experience in Astro Admin, with an integrated module collection behind it.
A complete B2B catalogue.
Explore SyncComms: approximately 1,000 products, guided finders, category filters and a quotation journey.
Explore SyncCommsMobile scores achieved.
See the dated mobile lab reports linked from our homepage, or test the live sites yourself. Results depend on the page and test conditions.
View the performance evidenceMake the move while you trade.
We can scope migrations, frontend rebuilds and new stores. Hosting, migration, training and custom development are agreed separately.
Discuss your projectYOUR NEXT STOREFRONT STARTS HERE
See what AgenticSuite could do for your business.
Explore the working sites, watch the overview, then talk to us about your catalogue and the store you want to build.