Is there a way to allow multiple cross-domains using the Access-Control-Allow-Origin
header?
I'm aware of the *
, but it is too open. I really want to allow just a couple domains.
As an example, something like this:
Access-Control-Allow-Origin: http://domain1.example, http://domain2.example
I have tried the above code but it does not seem to work in Firefox.
Is it possible to specify multiple domains or am I stuck with just one?
Best Answer
Sounds like the recommended way to do it is to have your server read the Origin header from the client, compare that to the list of domains you would like to allow, and if it matches, echo the value of the
Origin
header back to the client as theAccess-Control-Allow-Origin
header in the response.With
.htaccess
you can do it like this: