headers
Since CORS is administered by the server handling the requests, these are response headers. They allow the server to fine-tune its policy toward handling cross-origin requests.
Access-Control-Allow-Origin
This header gives the server the power to determine if the browser should share the response with requesting code from the given origin
- ex.
*
(wildcard) can be specified for requests without credentials. The value tells browsers to allow any Javascript from any origin to access the resource
Because setting this value to *
basically tells the server to handle requests from any client, it's usually not a good idea and specific origins should be set.
Access-Control-Allow-Credentials
This header gives the server the power to determine if the browser should expose the response to the front-end Javascript code when the request's credentials (Private) mode is include
.