Access-Control-Allow-Origin syntax

Question

I want allow Cross-origin resource sharing from all the sub-domain of from.example.com. So I added Cross-origin resource sharing header as given below to a page in subdomain1.to.example.com.

<?php header('Access-Control-Allow-Origin: *.from.example.com');

And I tried to access the page form subdomain1.from.example.com using ajax. I didn't get the response. So I just changed the above header as given below.

<?php header('Access-Control-Allow-Origin: http://subdomain1.from.example.com');

It works well for the subdomain1.from.example.com only.

What was the issue with first header?

stackoverflow.com/questions/12744278/…

Mohammed H
– Mohammed H

2013-03-12 02:09:42 +00:00
Commented Mar 12, 2013 at 2:09 — Mohammed H
– Mohammed H, Commented Mar 12, 2013 at 2:09

Community · Accepted Answer · 2021-10-07 05:49:19Z

18

Wildcards are not allowed in the Access-Control-Allow-Origin header. It has to be an exact match. You can either allow all domains by setting the value to *, or conditionally echo the value of the Origin request header if it matches one of your allowed domains.

Note that the Origin spec allows for multiple origins separated by a space. However I am not sure if this works with the Access-Control-Allow-Origin header. It may be worth a try.

edited Oct 7, 2021 at 5:49

CommunityBot

11 silver badge

answered Oct 5, 2012 at 15:13

monsur

48.3k19 gold badges104 silver badges96 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Access-Control-Allow-Origin syntax

1 Answer 1

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related