There are seemingly two ways to allow Cross Origin domains...
My preferred way of doing it, because it locks access down to only the specified domains that I allow.
- Set Origin Environment
SetEnvIf Origin "http(s)?://(www\.)?(([a-z0-9-]+).domain1.org|([a-z0-9-]+).domain2.org|test.devserver.org)$" AccessControlAllowOrigin=$0
- Use that Environment variable to add the header dynamicially
Header add Access-Control-Allow-Origin %{AccessControlAllowOrigin}e env=AccessControlAllowOrigin
Another way of doing it, which allows all Cross Domains.
Header add Access-Control-Allow-Origin "*"
The later one seems to work with no problems. But is less secure for the reasons noted above. I want to know why the first one causes me problems? The regex seems fine. I took the idea from here: https://stackoverflow.com/questions/1653308/access-control-allow-origin-multiple-origin-domains which is referenced on the W3C site.