Or it can be narrowed down to a specific origin: Access -Control -Allow -Origin : https : / /example. For example, to allow access from any origin, you can set this header as follows: Access -Control -Allow -Origin : * This header specifies which origins can access the resource. There are a few headers that can be set, but the primary one that determines who can access a resource is Access -Control -Allow -Origin. Web browsers can use these headers to determine whether or not an XMLHttpRequest call should continue or fail. Their presence can be used to determine that a request supports CORS. But, none of its settings are mandatory.When a server has been configured correctly to allow cross-origin resource sharing, some special headers will be included. This sets it to 86400 seconds which equals 24 hours.įor best performance, leave this rule and all of its behaviors in the configuration. This header determines how long the results of a preflight check can be cached. The response is then ignored by the browser and the content is not returned.Īccess-Control-Max-Age. For example, with this value set to true, if your origin server requires credentials (a cookie) to access cross-origin content, and no cookie is present, the 'credential check' fails. Credentials are cookies, authorization headers, or TLS client certificates.

When a request requires credentials for content, a browser will only pass the preflight check if the Access-Control-Allow-Credentials value is true. This modifies this header to set it to true. Akamai-Request-BC allows for CORS support with the Breadcrumbs feature with AMD.Īccess-Control-Allow-Credentials. The Akamai-Mon-Iucid-Ing and Akamai-Mon-Iucid-Del headers are included to support Akamai client-side analytics. This modifies this header so that only the Server, range, hdntl, hdnts, Akamai-Mon-Iucid-Ing, Akamai-Mon-Iucid-Del, and Akamai-Request-BC headers are supported.

This header indicates which response headers should be available to a script running in the requesting browser. The hdntl and hdnts headers are Akamai-specific headers used in the delivery of media content.Īccess-Control-Expose-Headers. This modifies this header so that only origin, range, hdntl, and hdnts request headers are supported. This header indicates which HTTP headers can be used during the request from a browser. This modifies this header to ensure that only the GET, POST, and OPTIONS methods are allowed in a request from the browser.Īccess-Control-Allow-Headers. This way, this header won't inadvertently block access to an origin that may host your content.Īccess-Control-Allow-Methods. This modifies this header value to ' *' to get the header to acknowledge all origin servers.

Set up watermarking in your AMD propertyĪccess-Control-Allow-Origin.

Caveats and known issues with Token Auth.

Caveats and known issues with Quick Retry.

Migrate from Enhanced TLS to Standard TLS.

No personally identifiable information (PII).

Optimize via different Client Characteristics.

Optimize via different Content Characteristics.

Separate origins using different auth methods.

Live & on-demand: One property hostname, different URL paths.

Live & on-demand: Different Property Hostnames.

Recommended behaviors in the Default Rule.

Add access control allow origin header