I would like to know is that possible to modify or remove Access-Control-Allow-Origin from Response Headers

Due to security reason, I need to change Access-Control-Allow-Origin from * to domain

I add in a new

<customHeaders>
    <add name="Access-Control-Allow-Origin" value="domain" />
</customHeaders>

But the header still displaying * in some of the pages, refer to the image below. enter image description here

Some other pages are reflecting the changes which is what I am looking for. enter image description here

May I know how to rectify this issue in order to make all of the page consistent?

  • where do you add this tag customHeaders ? – mmm Jul 19 '16 at 8:17
  • Under <httpProtocol> – WeeHong Jul 19 '16 at 8:25
  • @Kane the configuration you're describing is not a part of, and does not appear to pertain to WordPress. It sounds like a Microsoft IIS configuration to me, which is in general considered off-topic for our community. Your question would probably be a better fit over at serverfault – bosco Jul 19 '16 at 8:42
  • @bosco, my WordPress is running on IIS 7.0. It is not a server fault. My website still can function properly without any issue. I just want to modify the response headers only. – WeeHong Jul 19 '16 at 8:58
  • @Kane "Serverfault.com" is the Stack Exchange site that's focused on server configuration and operation - they know a lot more about IIS/Apache/Nginx than our community. Your question makes more sense there; here it may be considered "off-topic" since you're not actually asking anything about WordPress =] – bosco Jul 19 '16 at 9:00

Your Answer

 
discard

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.