Access-Control-Allow-Origin

Which other origin may read the response in a browser (CORS).

Header name, or pasted headers

Explained

Examples

Example

Access-Control-Allow-Origin: https://app.example.com

It takes one origin or *, not a list. With credentials (cookies), * is not allowed: echo the checked origin and add Vary: Origin.

Defined in Fetch standard, CORS protocol.