Thursday, May 24, 2012

Access-Control-Allow-Origin Multiple Origin Domains?

Is there a way to allow multiple cross-domains using the Access-Control-Allow-Origin header?

I'm aware of the *, but it is too open. I really want to allow just a couple domains.

As an example, something like this:


I have tried the above code but it doesn't seem to work in Firefox.

Is it possible to specify multiple domains or am I stuck with just one?

Source: Tips4all


  1. Sounds like the recommended way to do it is to have your server read the Origin header from the client, compare that to the list of domains you'd like to allow, and if it matches, echo the value of the Origin header back to the client as the Access-Control-Allow-Origin header in the response.

  2. The answer seems to be to use the header more than once. That is, rather than sending




    On Apache, you can do this in an httpd.conf <VirtualHost> section or .htaccess file using mod_headers and this syntax:

    Header add Access-Control-Allow-Origin ""
    Header add Access-Control-Allow-Origin ""
    Header add Access-Control-Allow-Origin ""

    The trick is to use add rather than append as the first argument.

  3. I had the same problem with woff-fonts, multiple subdomains had to have acces. To allow subdomains I added something lige this to my httpd.conf:

    SetEnvIf Origin "^(.*\.example\.com)$" ORIGIN_SUB_DOMAIN=$1
    <FilesMatch "\.woff$">
    Header set Access-Control-Allow-Origin "%{ORIGIN_SUB_DOMAIN}e" env=ORIGIN_SUB_DOMAIN

    For multiple domains you could just change the regex in SetEnvIf

  4. Another solution I'm using in PHP:

    $http_origin = $_SERVER['HTTP_ORIGIN'];

    if ($http_origin == "" || $http_origin == "" || $http_origin == "")
    header('Access-Control-Allow-Origin: *');

  5. There is one disadvantage you should be aware of: As soon as you out-source files to a CDN (or any other server which doesn't allow scripting) or if your files are cached on a proxy, altering response based on 'Origin' request header will not work.

  6. According to the W3C RFC see here
    you should be able to seperate them with a space

    so in your example:


    Sadly, I have tested this on FF and it doesn't work :-(

  7. Delimit them with a pipe character rather than a comma, as in this example: