HTTP Response Header is being overwritten. Where all can HTTP Response headers be set in apache?

Question

I have a PHP application where I conditionally set the Access-Control-Allow-Origin header. I see the change reflected on my local setup and on the dev environment, but on the live site, the header is set as something else. The other headers that I set along with it keep their values, so it leads me to believe that the Access-Control-Allow-Origin header is being overwritten somewhere else.

I've checked the .htaccess files in my project and the apache virtual host configuration file for possible places the header could be overwritten. It was being set in the virtual host config file, but I commented it out and restarted apache, but the header is still being overwritten.

Is there any other place that I can check to see if the header is being overwritten?

Thanks in advance for your help!

Here is the requested PHP code snippet:

    $origin=$front->getRequest()->getHeader('Origin');
    if($origin && (preg_match('/http[s]{0,1}:\/\/' . $front->getRequest()->getHttpHost() . '$/', $origin))){
        $front->getResponse()->setHeader('Access-Control-Allow-Origin', $origin);
        $front->getResponse()->setHeader('Access-Control-Allow-Credentials', 'true');
    }else{
        //leave current value if there is no match
        $front->getResponse()->setHeader('Access-Control-Allow-Origin', '*');
    }

I'm pretty sure the header is being overwritten by something else because I can see the Access-Control-Allow-Credentials:true come through as expected, but Access-Control-Allow-Origin has a value of * .

Answer 1

I did some more digging and found this link to do the same in the .htaccess. I ended up adding the following:

SetEnvIf Origin "^http(s)?://(.+\.)?(www.example.com)$" origin_is=$0
Header set Access-Control-Allow-Origin %{origin_is}e env=origin_is
Header set Access-Control-Allow-Credentials true env=origin_is

Answer 2

You can set header from htaccess:

<IfModule mod_headers.c>
    Header set Access-Control-Allow-Origin "*"
</IfModule>

Or from PHP:

header("access-control-allow-origin: *");

You can use:

<IfModule mod_headers.c>
  <FilesMatch "\.(ttf|ttc|otf|eot|woff|font.css|css)$">
    Header set Access-Control-Allow-Origin "*"
  </FilesMatch>
</IfModule>

to apply htaccess header for specified files.