Access-Control-Allow-Origin
ResponseActiveAccess-Control-Allow-Origin is the primary CORS response header. It tells the browser which origins are allowed to read the response. A value of '*' allows any origin (but disallows credentials). A specific origin (e.g., 'https://app.example.com') restricts access. Omitting this header blocks the cross-origin read entirely.
Access-Control-Allow-Origin: * | <origin> | null
Description
CORS (Cross-Origin Resource Sharing) uses Access-Control-Allow-Origin to selectively expose responses to different origins. When a browser makes a cross-origin request, it checks this header – if the requesting origin isn't listed, the browser blocks JavaScript from reading the response (the request still reaches the server). For credentialed requests, '*' is not allowed – a specific origin must be named.
Directives
| Directive | Description |
|---|---|
| * | Any origin allowed. Cannot be used with credentials (cookies, Authorization). |
| <origin> | Specific origin allowed. Only one value permitted – echo the request's Origin dynamically for multi-origin support. |
| null | Matches null origin (sandboxed iframes, file://). Avoid using – security risk. |
Examples
Public API
http
Access-Control-Allow-Origin: *Authenticated API
http
Access-Control-Allow-Origin: https://app.example.com
Access-Control-Allow-Credentials: true
Vary: OriginPreflight response
http
HTTP/1.1 204 No Content
Access-Control-Allow-Origin: https://app.example.com
Access-Control-Allow-Methods: GET, POST, DELETE
Access-Control-Max-Age: 86400