访问控制允许带有和不带有 www 的来源

Question

I built a php API with the following header:

header("Access-Control-Allow-Origin: https://my-domain.de");

With that, I can access the api only from https://my-domain.de but not from https://www.my-domain.de

I get:

Origin https://www.my-domain.de is not allowed by Access-Control-Allow-Origin.
[Error] XMLHttpRequest cannot load https://my-domain.de/checkin/api/generateUser.php due to access control checks.

How can I make this working for both: www and without www?

Answer 1

You can just add another line:

header("Access-Control-Allow-Origin: https://my-domain.de");
header("Access-Control-Allow-Origin: https://www.my-domain.de");

PHP doesn't support wildcard headers, you either support all domains:

header("Access-Control-Allow-Origin: *");

Or specific as above