Articles/HTTP

Access-Control-Allow-Origin Header Explained

What the HTTP Access-Control-Allow-Origin header does and when it's used.

Published October 15, 2026

The Access-Control-Allow-Origin header tells the browser which origin(s) are allowed to read a cross-origin response.

Key points

  • A wildcard (*) allows any origin but disables sending credentials like cookies with the request
More HTTP articles