Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

With nginx can I specify Access-Control-Allow-Origin using a wildcard like *.mydomain.com?

Would it look like:

add_header Access-Control-Allow-Origin *.mydomain.com;

Thanks.

share|improve this question

1 Answer 1

up vote 0 down vote accepted

You sure can. I use the following directive to support some of our cross domain fonts:

  add_header Access-Control-Allow-Origin *;
share|improve this answer
    
No I don't want wildcard for everything, but only anything.mydomain.com. I have a SaaS and each signup get's their own subdomain (user.mydomain.com). Also, I am testing and put add_header Access-Control-Allow-Origin http://google.com; for testing, and assumed requests would fail, but surprisingly they still work. Any idea why? They should fail right? –  Justin Feb 5 '13 at 20:13
    
Ah, I understand. Yes, you can use globs, though I can't say for certain why requests aren't failing like they should. The very long answer on how to use Access-Control is here: w3.org/TR/2008/WD-access-control-20080912 –  Stephan Feb 5 '13 at 20:18
    
Actually further research, shows that Access-Control-Allow-Origin only supports * and a full host, i.e. wildcard domains are NOT supported. However still not sure why requests are working when I set: add_header Access-Control-Allow-Origin https://google.com; –  Justin Feb 5 '13 at 20:24
    
Ah, seems I learned something as well then! –  Stephan Feb 5 '13 at 20:27
    
I posted my new problem if you wish to follow or provide further insight. Thanks. stackoverflow.com/questions/14716322/… –  Justin Feb 5 '13 at 20:41

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.