将请求中的 Origin 添加到响应中的 Access-Control-Allow-Origin 标头

Question

I'd like to allow all origins to fetch resources from my apache server.

Instead of adding:

Access-Control-Allow-Origin: *

I would like my server to craft a special response with :

Access-Control-Allow-Origin: <the value of the Origin received in the request>

Is there something I can add to httpd.conf to achieve this ?

Answer 1

Seems it can be achieved by adding those two lines:

SetEnvIf Origin ".*\S.*" ORIGIN=$0
Header always set Access-Control-Allow-Origin %{ORIGIN}e env=ORIGIN

The regex pretty much means anything except newline, tab, and space, so as long as the Origin is not empty add it to the response header.