Access-Control-Allow-Origin (CORS)
Tells browsers which specific origins are permitted to access resources via XMLHttpRequest or Fetch API across domains.
https://app.example.com (Never wildcard * with credentials)Production Server Implementation
add_header Access-Control-Allow-Origin "https://app.example.com" always;Directives & Syntax Breakdown
Explicitly authorizes only the trusted domain to read cross-origin API responses.
Wildcard allowing any public website to fetch response (safe only for truly public static assets).
Common Security Hazards & Pitfalls
- •Browsers reject responses with "*" wildcard if "Access-Control-Allow-Credentials: true" is present.
- •Never echo back the request "Origin" header blindly without validation.
Access-Control-Allow-Origin (CORS) - Questions & Answers
Common implementation questions, browser enforcement rules, and debugging.
CORS is a browser security sandbox mechanism. Postman and cURL are terminal utilities that do not enforce the browser Same-Origin Policy.
Related HTTP Headers
Browse All HeadersRestricts where scripts, images, styles, and frames can be loaded from, protecting websites from Cross-Site Scripting (XSS) and data injection attacks.
Forces modern web browsers to communicate exclusively over encrypted HTTPS connections, preventing SSL stripping and man-in-the-middle (MITM) attacks.
Indicates whether a browser should be allowed to render a page inside an <iframe>, <frame>, or <object>, protecting users against clickjacking attacks.
Prevents the browser from MIME-sniffing a response away from the declared Content-Type header, mitigating drive-by malware and MIME confusion attacks.
Controls how much referrer information (URL path and query parameters) is included when navigating away or loading external assets.
Allows site owners to selectively restrict browser hardware features, sensors, APIs, and privacy-invasive tracking mechanisms.