// http header · cors header
Access-Control-Allow-Origin
Origins allowed to read the response
What the Access-Control-Allow-Origin header does
Access-Control-Allow-Origin is the core CORS response header: it names the origin allowed to read the response, or * for any. Without a matching value, the browser blocks the calling page from reading a cross-origin response, even though the request itself may have reached the server.
Example
Access-Control-Allow-Origin: *Where it's used
Access-Control-Allow-Origin is a cors header. CORS headers govern cross-origin requests — which other origins may read a response.
Other cors headers
Access-Control-Allow-Origin Access-Control-Allow-Methods Access-Control-Allow-Headers Access-Control-Allow-Credentials Access-Control-Max-Age