Keyboard shortcuts

Press ← or → to navigate between chapters

Press S or / to search in the book

Press ? to show this help

Press Esc to hide this help

CORS (Cross-Origin Resource Sharing)

Default CORS variables in response

HeaderValue
Access-Control-Allow-MethodsGET, POST, PUT, DELETE, OPTIONS
Access-Control-Allow-Headers*
Access-Control-Max-Age86400

Variation due to request

If Origin is got from request and looks like authorized request including Cookie or Authorization header:

HeaderValue
Access-Control-Allow-OriginRequest Origin value
VaryOrigin
Access-Control-Allow-Credentialstrue

Else:

HeaderValue
Access-Control-Allow-Origin*
Vary*
Access-Control-Allow-Credentials(not set)