headers

Since CORS is administered by the server handling the requests, these are response headers. They allow the server to fine-tune its policy toward handling cross-origin requests.

Access-Control-Allow-Origin

This header gives the server the power to determine if the browser should share the response with requesting code from the given origin

  • ex. * (wildcard) can be specified for requests without credentials. The value tells browsers to allow any Javascript from any origin to access the resource

Because setting this value to * basically tells the server to handle requests from any client, it's usually not a good idea and specific origins should be set.

Access-Control-Allow-Credentials

This header gives the server the power to determine if the browser should expose the response to the front-end Javascript code when the request's credentials (Private) mode is include.