Tobiasco: Created page with " https://www.w3.org/TR/cors/#access-control-allow-origin-response-header In practice the origin-list-or-null production is more constrained. Rather than allowing a space-se..."

2018-08-23T17:58:32Z

Created page with " https://www.w3.org/TR/cors/#access-control-allow-origin-response-header In practice the origin-list-or-null production is more constrained. Rather than allowing a space-se..."

New page

https://www.w3.org/TR/cors/#access-control-allow-origin-response-header
In practice the origin-list-or-null production is more constrained.
Rather than allowing a space-separated list of origins, it is either a single origin or the string "null".

==multiple values==
* seperator in Apache can be comma - no space after comma!
* multiple values rejected by Chrome

Store list in Apache and only return the matched one
https://stackoverflow.com/questions/1653308/access-control-allow-origin-multiple-origin-domains

# ----------------------------------------------------------------------
# Allow loading of external fonts
# ----------------------------------------------------------------------
<FilesMatch "\.(ttf|otf|eot|woff)$">
<IfModule mod_headers.c>
SetEnvIf Origin "http(s)?://(www\.)?(google.com|staging.google.com|development.google.com|otherdomain.example|dev02.otherdomain.example)$" AccessControlAllowOrigin=$0
Header add Access-Control-Allow-Origin %{AccessControlAllowOrigin}e env=AccessControlAllowOrigin
Header merge Vary Origin
</IfModule>
</FilesMatch>

Access-Control-Allow-Origin - Revision history

Tobiasco: Created page with " https://www.w3.org/TR/cors/#access-control-allow-origin-response-header In practice the origin-list-or-null production is more constrained. Rather than allowing a space-se..."