Cross-Origin Resource Sharing

CORS

BROWSER SUPPORT

ALLOW ACCESS FROM ALL DOMAINS

// Raw header
Access-Control-Allow-Origin: *

// How to send the response header with PHP
header("Access-Control-Allow-Origin: *");

// How to send the response header with Apache (.htaccess)
Header set Access-Control-Allow-Origin "*"

// How to send the response header with Nginx
add_header 'Access-Control-Allow-Origin' '*';

// How to send the response header with Express.js
app.use(function(req, res, next) {
    res.header("Access-Control-Allow-Origin", "*");
    next();
});

ALLOW ACCESS FROM SPECIFIC DOMAIN

// Raw header
Access-Control-Allow-Origin https://www.domain.com

// How to send the response header with PHP
header("Access-Control-Allow-Origin: https://www.example.org");

// How to send the response header with Apache (.htaccess)
Header set Access-Control-Allow-Origin "https://zinoui.com"

// How to send the response header with Nginx
add_header 'Access-Control-Allow-Origin' 'https://zinoui.com';

// How to send the response header with Express.js
app.use(function(req, res, next) {
    res.header("Access-Control-Allow-Origin", "https://plus.google.com");
    next();
});

REQUEST HEADERS

• Origin
  The Origin header shows the server name where the cross-domain/preflight request originates.
• Access-Control-Request-Method
  The Access-Control-Request-Method header is sent to the server as part of the preflight request and informs it about the HTTP method that will be used in the actual request.
• Access-Control-Request-Headers
  The Access-Control-Request-Headers header is sent to the server as part of the preflight request and informs it about headers that will be used in the actual request.

RESPONSE HEADERS

• Access-Control-Allow-Origin
  The Access-Control-Allow-Origin header indicates whether a resource can be shared.
• Access-Control-Allow-Credentials
  The Access-Control-Allow-Credentials header indicates whether the response to request can be exposed when the credentials flag is true.
• Access-Control-Expose-Headers
  The Access-Control-Expose-Headers response header brings information about headers that browsers could allow accessing.
• Access-Control-Max-Age
  The Access-Control-Max-Age header indicates how much time, the result of a preflight request, can be cached.
• Access-Control-Allow-Methods
  The Access-Control-Allow-Methods header is returned by the server in a response to a preflight request and informs the browser about the HTTP methods that can be used in the actual request.
• Access-Control-Allow-Headers
  The Access-Control-Allow-Headers header is returned by the server in a response to a preflight request and informs the browser about the HTTP headers that can be used in the actual request.