1

According to MDN,

when responding to a credentialed request, server must specify a domain, and cannot use wild carding.

So I cannot simply use Access-Control-Allow-Origin: *. However, I'm wondering if there is a reason not to simply use: Access-Control-Allow-Origin: ${request.headers["Origin"]}, i.e., always set Access-Control-Allow-Origin to whatever Origin was set to in the request.

Soumya
  • 13,677
  • 6
  • 34
  • 49

1 Answers1

0

There isn't.

It has been discussed (rather indirectly) in this thread : Access-Control-Allow-Origin Multiple Origin Domains?

In your case, your list of domains are all domains, which means no matter what the request originates from, it is in your 'list of domains'.

Community
  • 1
  • 1
fyquah95
  • 818
  • 6
  • 18