Access-Control-Allow-Origin

Access-Control-Allow-Origin: https://app.example.com

What it does

The CORS verdict: which origin may read this response from JavaScript.

In practice

The header everyone meets via an error message. Three things that unstick most CORS sessions: the value must be a single origin or *, never a list; * is incompatible with credentialed requests (cookies) — you must echo the specific origin AND send Access-Control-Allow-Credentials: true; and the error appearing on a preflight means the OPTIONS request needs the headers too, not just the real one. CORS protects the BROWSER's user; it does nothing against curl.

← All headers