How to configure apache to handle multiple domains with Access-Control-Allow-Origin header?

Question

I want to configure apache to allow XMLHttpRequests from multiple, but not all domains.

This works:

Header set Access-Control-Allow-Origin "*"

But it's unsafe, I want to allow domains specified by me, so after a bit of googling I got to this:

Header set Access-Control-Allow-Origin "http://domain1.com http://domain2.com"

But this only picks up first domain, the second is not allowed. How to properly specify multiple domains?

Answer 1

you can use SetEnvIf in your .htaccess file or in in vhost file (inside "Directory" group):

<IfModule mod_headers.c>
   SetEnvIfNoCase Origin "https?://(www\.)?(mydomain\.com|mydomain2\.com)(:\d+)?$" AccessControlAllowOrigin=$0
   Header set Access-Control-Allow-Origin %{AccessControlAllowOrigin}e env=AccessControlAllowOrigin
</IfModule>

With this code you can allow access from

• "mydomain.com" and "mydomain2.com"
• with or without "www." in front
• with or without port number
• http or https

You can add multiple domains separated with | or you can use regexp to configure different subdomains or patterns.