No 'Access-Control-Allow-Origin' for 2 different domains or sub-domains CORS issue

Question

There are a lot o topics about 'Access-Control-Allow-Origin', but I couldn't find one for Openseadragon which is for sub-domain name. My website is exampple.domain.com trying to open DZI from anotherexampple.domain.com and I have an error:

XMLHttpRequest cannot load anotherexampple.domain.com/123.dzi. No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'exampple.domain.com' is therefore not allowed access.

Both websites are using the same protocol HTTPS, and server is IIS

Server for exampple.domain.com is set up with:

Access-Control-Allow-Origin: *

And server for anotherexampple.domain.com is set up with:

Access-Control-Allow-Origin: *.domain.com

Also, openseadragon has settings:

crossOriginPolicy: 'Anonymous',
ajaxWithCredentials: false,

Can somebody tell me how to fix CORS issue for same domain with different sub-domains? Thanks in advance.

[Please don't put tags in question titles](https://stackoverflow.com/help/tagging) — Liam, Jun 15 '17 at 15:32
"Can somebody tell me how to fix CORS issue for same domain with different sub-domains?" — The same way you fix cross-origin issues for any other pair of origins that are not the same as each other. — Quentin, Jun 15 '17 at 15:35

Quentin · Accepted Answer · 2017-06-15T15:41:26.780

3

Access-Control-Allow-Origin: *.domain.com

The Access-Control-Allow-Origin header doesn't support partial wildcards.

Either use * or the full origin name.

You can read the Origin request header, pattern match it, and then echo it out on the server if you want to whitelist everything on a particular domain.

No 'Access-Control-Allow-Origin' header is present on the requested resource.

You might have tried to set the Access-Control-Allow-Origin header, but it clearly hasn't worked. You need to reexamine your configuration.

edited Jun 15 '17 at 15:41

answered Jun 15 '17 at 15:36

Quentin

914,110
126
1,211
1,335

I changed it, and still doesn't work. But thank you for letting me know. This was silly mistake. – Observer Jun 15 '17 at 15:40
and where does this line go? – lesolorzanov Jan 23 '18 at 04:26
@ZloySmiertniy — What line? – Quentin Jan 23 '18 at 08:04

score 0 · Answer 2 · answered Jan 30 '20 at 12:35

This link has a nice explanation for possible values for 'Access-Control-Allow-Origin'. unfortunately you do not have much options, other than '*' or single domain like 'http://example.com'

https://www.moesif.com/blog/technical/cors/Authoritative-Guide-to-CORS-Cross-Origin-Resource-Sharing-for-REST-APIs/

No 'Access-Control-Allow-Origin' for 2 different domains or sub-domains CORS issue

2 Answers2