CORS · Response header
Access-Control-Allow-Origin
Which origins may read this response cross-origin.
What is Access-Control-Allow-Origin?
The core CORS header. `*` allows any origin (but blocks credentials); a specific origin like `https://app.example.com` allows only that one. Set on responses to preflight and simple cross-origin requests.
Typical usage
Required on any endpoint that browsers should call from another origin.
Examples
Allow any origin
Access-Control-Allow-Origin: *Allow one origin
Access-Control-Allow-Origin: https://app.example.comCommon gotchas
You cannot combine `*` with `Access-Control-Allow-Credentials: true`. To send cookies cross-origin, echo the request Origin and set credentials true.
Also known as
Also commonly written as: cors header · cors allow origin · access control allow origin · access-control-allow-origin header · cors wildcard · cors star · cors credentials · CORS ヘッダ. These variants — including plural forms, unhyphenated spellings, and Japanese (ヘッダ) — all refer to the same Access-Control-Allow-Origin HTTP header.
Specification
Fetch Standard §CORS
Frequently asked questions
What is the Access-Control-Allow-Origin HTTP header?
The core CORS header. `*` allows any origin (but blocks credentials); a specific origin like `https://app.example.com` allows only that one. Set on responses to preflight and simple cross-origin requests.
Is Access-Control-Allow-Origin a request or response header?
Access-Control-Allow-Origin is a response header — the server sends it to the client. Required on any endpoint that browsers should call from another origin.
What does a Access-Control-Allow-Origin header look like?
A typical Access-Control-Allow-Origin header looks like: Access-Control-Allow-Origin: * (Allow any origin).
What are common mistakes with Access-Control-Allow-Origin?
You cannot combine `*` with `Access-Control-Allow-Credentials: true`. To send cookies cross-origin, echo the request Origin and set credentials true.
Related headers
Access-Control-Allow-Methods
Which HTTP methods are allowed on the cross-origin resource.
Access-Control-Allow-Headers
Which request headers may be used in the actual cross-origin request.
Access-Control-Allow-Credentials
Whether cookies and Authorization can be sent cross-origin.
Origin
The origin (scheme + host + port) of the request.
Access-Control-Max-Age
How long the browser may cache the preflight response.