DevToolsmith

Access-Control-Allow-Origin Header

The Access-Control-Allow-Origin response header tells the browser which origin may read a cross-origin response.

Type
Response header
Category
CORS
Defined in
Fetch Standard

Syntax

Access-Control-Allow-Origin: *  |  Access-Control-Allow-Origin: <origin>

How Access-Control-Allow-Origin works

Without it, the browser makes the request but hides the response from JavaScript and reports a CORS error. The value is a single origin or *; a list is not allowed, so servers that accept several origins check the request’s Origin header and echo it back, together with Vary: Origin.

Values

Value Meaning
* Any origin may read the response. Not allowed together with credentials (cookies or Authorization).
https://app.example.com Only this exact origin: scheme, host and port must match, with no trailing slash.
null Matches sandboxed iframes and file:// pages. Avoid: many unrelated contexts send Origin: null.

Examples

Public API
Access-Control-Allow-Origin: *
One app, with cookies
Access-Control-Allow-Origin: https://app.example.com
Access-Control-Allow-Credentials: true
Vary: Origin

Common mistakes

  • CORS errors are enforced by the browser, not the server: curl and Postman get the response either way, which is why “it works in Postman” says nothing about CORS.
  • The header must also be on error responses (4xx, 5xx), or the browser reports a CORS error instead of the real status code.

Check it

curl -sI https://example.com | grep -i '^access-control-allow-origin:'

Paste a full set of response headers into the HTTP header checker to get every header explained and common mistakes flagged.

Related headers

  • Access-Control-Allow-Credentials: allows a cross-origin request made with cookies or HTTP authentication to read the response.
  • Origin: tells the server which origin (scheme, host and port) a request comes from.
  • Access-Control-Allow-Methods: lists the HTTP methods allowed for a cross-origin request, in answer to a preflight.
  • Vary: lists the request headers that change the response, so caches keep a separate copy for each value.

More cors headers

Access-Control-Allow-Headers , Access-Control-Expose-Headers , Access-Control-Max-Age .

Sources

Spotted a mistake? Email hello@devtoolsmith.com and we’ll fix it.

Frequently asked questions

What does the Access-Control-Allow-Origin header do?

The Access-Control-Allow-Origin response header tells the browser which origin may read a cross-origin response. Without it, the browser makes the request but hides the response from JavaScript and reports a CORS error. The value is a single origin or *; a list is not allowed, so servers that accept several origins check the request’s Origin header and echo it back, together with Vary: Origin.

How do I see the Access-Control-Allow-Origin header?

Run "curl -sI https://example.com" to print a response’s headers, or open the Network tab in your browser’s dev tools and select the request. Paste the headers into the HTTP header checker on this site to get each one explained.