Access-Control-Allow-Origin

The Access-Control-Allow-Origin response header indicates whether the response can be shared with resources with the given origin.

Syntax

Access-Control-Allow-Origin: *
Access-Control-Allow-Origin: <origin>

Directives

*

For requests without credentials, the server may specify "*" as a wildcard, thereby allowing any origin to access the resource.

<origin>

Specifies a URI that may access the resource.

Examples

To allow any resource to access your resource, you can specify:

Access-Control-Allow-Origin: *

To allow https://developer.mozilla.org to access your resource, you can specify:

Access-Control-Allow-Origin: https://developer.mozilla.org

CORS and caching

If the server specifies an origin host rather than "*", then it must also include Origin in the Vary response header to indicate to clients that server responses will differ based on the value of the Origin request header.

Access-Control-Allow-Origin: https://developer.mozilla.org
Vary: Origin

Specifications

Browser compatibility

The compatibility table in this page is generated from structured data. If you'd like to contribute to the data, please check out https://github.com/mdn/browser-compat-data and send us a pull request.

See also

• Origin
• Vary