Access-Control-Allow-Origin
CORS response header. Specifies which origins can read the response. * allows any; otherwise specific origin.
ResponseSyntax
Access-Control-Allow-Origin: <origin> | *Example values
| Value | Explanation |
|---|---|
| * | Allow any origin (no credentials) |
| https://app.example.com | Single origin |
cURL usage
curl -i -H 'Origin: https://other.com' https://api.example.com # Check CORS
Common mistakes
Using * with credentials; missing for preflight OPTIONS.