CORS
Access-Control-Allow-Origin
Specifies which origins are permitted to read the response, the fundamental CORS header.
Syntax
Access-Control-Allow-Origin: * | <origin>Example
Access-Control-Allow-Origin: https://example.comDescription
Access-Control-Allow-Origin is the most important CORS header. Tells the browser which origins can access the response.
Value: specific origin (e.g., https://example.com) or * (any origin). * cannot be used with credentials.
For security, avoid * on sensitive endpoints. Validate the Origin header against an allowlist. Always include Vary: Origin when dynamic.
Check if your website sends this header correctly
Check your headers →