3

Infosec has recommended us to use this header :

Access-Control-Allow-Origin:http://domainA.mycompany.com,http://*.mycompany.com

But I also own domain : http://domainB.mycompany.com

So, if i just use

Access-Control-Allow-Origin:http://*.mycompany.com

Will this be enough ? or it needs to be domain specific ?

5

Your server side code should read the Origin request header and if it pattern matches one of your domains (http://*.mycompany.com) then you can return Access-Control-Allow-Origin: <domain> where <domain> is the actual Origin given in the request.

So if your request header is

Origin: http://foo.mycompany.com

this will match http://*.mycompany.com

so you set

Access-Control-Allow-Origin: http://foo.mycompany.com

for this response.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.