Infosec has recommended us to use this header :


But I also own domain : http://domainB.mycompany.com

So, if i just use


Will this be enough ? or it needs to be domain specific ?


1 Answer 1


Your server side code should read the Origin request header and if it pattern matches one of your domains (http://*.mycompany.com) then you can return Access-Control-Allow-Origin: <domain> where <domain> is the actual Origin given in the request.

So if your request header is

Origin: http://foo.mycompany.com

this will match http://*.mycompany.com

so you set

Access-Control-Allow-Origin: http://foo.mycompany.com

for this response.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .