Skip to main content

Access-Control-Allow-Origin Multiple Origin Domains?


Is there a way to allow multiple cross-domains using the Access-Control-Allow-Origin header?



I'm aware of the *, but it is too open. I really want to allow just a couple domains.



As an example, something like this:




Access-Control-Allow-Origin: http://domain1.com, http://domain2.com



I have tried the above code but it doesn't seem to work in Firefox.



Is it possible to specify multiple domains or am I stuck with just one?


Source: Tips4allCCNA FINAL EXAM

Comments

  1. Sounds like the recommended way to do it is to have your server read the Origin header from the client, compare that to the list of domains you'd like to allow, and if it matches, echo the value of the Origin header back to the client as the Access-Control-Allow-Origin header in the response.

    ReplyDelete
  2. I had the same problem with woff-fonts, multiple subdomains had to have acces. To allow subdomains I added something lige this to my httpd.conf:

    SetEnvIf Origin "^(.*\.example\.com)$" ORIGIN_SUB_DOMAIN=$1
    <FilesMatch "\.woff$">
    Header set Access-Control-Allow-Origin "%{ORIGIN_SUB_DOMAIN}e" env=ORIGIN_SUB_DOMAIN
    </FilesMatch>


    For multiple domains you could just change the regex in SetEnvIf

    ReplyDelete
  3. Another solution I'm using in PHP:

    $http_origin = $_SERVER['HTTP_ORIGIN'];

    if ($http_origin == "http://www.domain1.com" || $http_origin == "http://www.domain2.com" || $http_origin == "http://www.domain3.info")
    {
    header('Access-Control-Allow-Origin: *');
    }

    ReplyDelete
  4. There is one disadvantage you should be aware of: As soon as you out-source files to a CDN (or any other server which doesn't allow scripting) or if your files are cached on a proxy, altering response based on 'Origin' request header will not work.

    ReplyDelete
  5. Delimit them with a pipe character rather than a comma, as in this example:

    https://developer.mozilla.org/En/HTTP_Access_Control

    ReplyDelete

Post a Comment

Popular posts from this blog

Slow Android emulator

I have a 2.67 GHz Celeron processor, 1.21 GB of RAM on a x86 Windows XP Professional machine. My understanding is that the Android emulator should start fairly quickly on such a machine, but for me it does not. I have followed all instructions in setting up the IDE, SDKs, JDKs and such and have had some success in staring the emulator quickly but is very particulary. How can I, if possible, fix this problem?

CCNA 3 Final Exam => latest version

1 . Which security protocol or measure would provide the greatest protection for a wireless LAN? WPA2 cloaking SSIDs shared WEP key MAC address filtering   2 . Refer to the exhibit. All trunk links are operational and all VLANs are allowed on all trunk links. An ARP request is sent by computer 5. Which device or devices will receive this message? only computer 4 computer 3 and RTR-A computer 4 and RTR-A computer 1, computer 2, computer 4, and RTR-A computer 1, computer 2, computer 3, computer 4, and RTR-A all of the computers and the router   3 . Refer to the exhibit. Hosts A and B, connected to hub HB1, attempt to transmit a frame at the same time but a collision occurs. Which hosts will receive the collision jamming signal? only hosts A and B only hosts A, B, and C only hosts A, B, C, and D only hosts A, B, C, and E   4 . Refer to the exhibit. Router RA receives a packet with a source address of 192.168.1.65 and a destination address of 192.168.1.161...