{{HTTPSidebar}}
The Access-Control-Allow-Origin
response header indicates whether the response can be shared.
Header type | {{Glossary("Request header")}} |
---|---|
{{Glossary("Forbidden header name")}} | no |
Syntax
Access-Control-Allow-Origin: * Access-Control-Allow-Origin: <origin>
Directives
- *
- For requests without credentials, the server may specify "*" as a wildcard, thereby allowing any origin to access the resource.
- <origin>
- Specifies a URI that may access the resource.
Examples
To allow any resource to access your resource, you can specify:
Access-Control-Allow-Origin: *
To allow https://developer.mozilla.org
to access your resource, you can specify:
Access-Control-Allow-Origin: https://developer.mozilla.org
CORS and caching
If the server specifies an origin host rather than "*
", then it must also include Origin
in the {{HTTPHeader("Vary")}} response header to indicate to clients that server responses will differ based on the value of the Origin
request header.
Access-Control-Allow-Origin: https://developer.mozilla.org Vary: Origin
Specifications
Specification | Status | Comment |
---|---|---|
{{SpecName('Fetch','#http-access-control-allow-origin')}} | {{Spec2("Fetch")}} |
Browser compatibility
The compatibility table in this page is generated from structured data. If you'd like to contribute to the data, please check out https://github.com/mdn/browser-compat-data and send us a pull request.
{{Compat}}
See also
- {{HTTPHeader("Origin")}}
- {{HTTPHeader("Vary")}}