3

Infosec has recommended us to use this header :

Access-Control-Allow-Origin:http://domainA.mycompany.com,http://*.mycompany.com

But I also own domain : http://domainB.mycompany.com

So, if i just use

Access-Control-Allow-Origin:http://*.mycompany.com

Will this be enough ? or it needs to be domain specific ?

Improve this question
1

1 Answer 1

Reset to default
5

Your server side code should read the Origin request header and if it pattern matches one of your domains (http://*.mycompany.com) then you can return Access-Control-Allow-Origin: <domain> where <domain> is the actual Origin given in the request.

So if your request header is

Origin: http://foo.mycompany.com

this will match http://*.mycompany.com

so you set

Access-Control-Allow-Origin: http://foo.mycompany.com

for this response.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .