Access-Control-Allow-Origin
changes the protection offered to the end user in regards to how the Same Origin Policy handles AJAX responses.
If a user is willing to mess around with host files in order to change this protection even further on their own, then the only thing they are compromising is their own security.
The header allows another origin to read an AJAX response if a cross-origin request is sent to the origin that outputs the header.
Can I use Access-Control-Allow-Origin: *
instead of
Access-Control-Allow-Origin: http://example.com
? What's the
difference?
The difference is the first option allows any origin to read AJAX responses. The second option only allows http://example.com
to read AJAX responses.
If Access-Control-Allow-Credentials
is true, then the first option won't work - CORS will not let you open your website up to global credentialled requests. If it did, and your website held confidential information (for example Gmail may have an AJAX function that returns the messages in the inbox), then any website a user visits would be able to read this confidential information from your website in the context of the current user's session.
If you do actually desire all origins to be able to read from the current user's session, then you can read the Origin
request header and then reflect this origin in the Access-Control-Allow-Origin
header (taking care to properly sanitise of course, removing CRLFs and the like). This would effectively be the same as outputting Access-Control-Allow-Origin: *
and allowing credentialed requests via Access-Control-Allow-Credentials
.