I currently use this which works perfectly in allowing cross-domain Ajax requests.

SetEnvIf Origin "^http(s)?://(.+\.)?(my-specified-domain\.com)$" origins_is=$0
Header add Access-Control-Allow-Origin %{origin_is}e env=origin_is�
Header add Access-Control-Allow-Credentials: true�

However, is it possible to do this without hard-coding the domain name?

I believe you can't embed a variable inside SetEnv and I just can't see a way to allow the alternative scheme, whatever domain you are hosting the site on.

Surely this is an obvious and essential requirement. Who wants to hard-code the domain every time?

Maybe the best way would be to match up against the ServerName setting (e.g. in the virtual host). If the URL matches that (regardless of scheme) then allow the cross-domain request.


You can:

Header add Access-Control-Allow-Origin *

But I think it's too permissive, I dont recommend it for a production website.


I havent tried but with something similar you should get the origin based on http Origin header:

SetEnvIfNoCase Origin ^(.*)$ origin=$1
| improve this answer | |
  • 1
    Thanks, but this isn't answering the question. I want to be able to do this for a set domain name - not any domain. My issue is having to hard-code the domain. – user2143356 May 6 '14 at 18:17
  • Replace you hardcoded domain for a regex with a capturing group matching a generic domain. – R.Sicart May 6 '14 at 21:36
  • Check edit in answer. – R.Sicart May 6 '14 at 21:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.