Access-Control-Allow-Origin
Origins allowed to read the response
What the Access-Control-Allow-Origin header does
Access-Control-Allow-Origin is the core CORS response header: it names the origin allowed to read the response, or * for any. Without a matching value, the browser blocks the calling page from reading a cross-origin response, even though the request itself may have reached the server.
Example
Access-Control-Allow-Origin: *Access-Control-Allow-Origin in practice
Single origin
Access-Control-Allow-Origin: https://app.example.com
Vary: OriginPublic, non-credentialed API
Access-Control-Allow-Origin: *Common Access-Control-Allow-Origin questions and problems
"No 'Access-Control-Allow-Origin' header is present on the requested resource"
The server's response did not include this header for the requesting origin, so the browser blocked JavaScript from reading it. Add the header on the server that owns the resource. Changing the client cannot fix it.
Can I list several origins?
No. The value is either a single origin, *, or null. To support several origins, compare the request's Origin header with an allow-list and echo back the matching one.
Why does * not work with cookies?
When a request includes credentials, the response must name the specific origin, and Access-Control-Allow-Credentials: true must be present. A wildcard is rejected.
Do I need Vary: Origin?
Yes, when the value changes per request. Add Vary: Origin so caches do not serve one origin's response to another.
Access-Control-Allow-Origin vs related headers
- Access-Control-Allow-Methods: Allow-Origin says who may read the response. Allow-Methods lists which methods are permitted in a preflighted request.
- Access-Control-Allow-Headers: Allow-Headers lists which request headers a cross-origin request may send.
- Access-Control-Allow-Credentials: Allow-Credentials decides whether cookies and auth headers are included. It changes what Allow-Origin may be.
Where it's used
Access-Control-Allow-Origin is a cors header. CORS headers govern cross-origin requests — which other origins may read a response.