'What is the default value of Access-Control-Allow-Origin header?
Is "*" or the server's URI the default value for Access-Control-Allow-Origin header? If the header is not set, does it mean that every origin has access to the resource?
Solution 1:[1]
There is no default value.
If it isn't set, then it isn't set. If it is set, then it must have an explicit value.
If the header is not set, does it mean that every origin has access to the resource?
No. It means that the Same Origin Policy is enforced as normal. No origins are granted permission.
the server's URI
There is no reason to ever set the Access-Control-Allow-Origin to be the server's own URL. Same Origin requests don't need permission from CORS.
Solution 2:[2]
Came across this looking for the headers that work without CORS and found this nice safe list from Mozilla: https://developer.mozilla.org/en-US/docs/Glossary/CORS-safelisted_request_header
A CORS-safelisted request header is one of the following HTTP headers:
Accept,
Accept-Language,
Content-Language,
Content-Type.
Sources
This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.
Source: Stack Overflow
| Solution | Source |
|---|---|
| Solution 1 | Quentin |
| Solution 2 | Brian Leishman |