We've added Access-Control-Allow-Origin: *.domain.com and I'm able to view this in the response header. But how can I make sure this is implemented in the right way.

When I modify Origin or Referer I still get response for the request.

  • 2
    press [F12], goto "Console", try something like fetch('//my.site').then(alert). if nothing happens, you're ok. if you see a "Javascript message", it's not working. – dandavis Nov 10 '17 at 8:07

Cors only works for ajax requests, not direct http requests. Before the GET request is issued in an ajax request, an OPTIONS request is issued to determine if it is from a valid domain. If it violates the CORS policy, the GET request is never issued. This doesn’t happen if you just issue a direct get request. A good way to test is to write some javascript that fires off an ajax request and deploy it to a server that is on a different domain. Visit that domain, and see if the call succeeds. With the header that you listed above, it won’t.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.