Following from my previous question Is it safe to fix Access-Control-Allow-Origin (CORS origin) errors with a php header directive?

The only solution that worked for me was:

header("Access-Control-Allow-Origin: http://mozilla.com");

However, I have 4 subdomains that I need to enable them to access the data on the main domain.

I tried to repeat the command, like this:

header("Access-Control-Allow-Origin: http://site1.com");
header("Access-Control-Allow-Origin: http://site2.com");
header("Access-Control-Allow-Origin: http://site3.com");

but it did not work.

I tried the solution posted by @yesthatguy in this response to this question: Access-Control-Allow-Origin Multiple Origin Domains?

I used this code:

<IfModule mod_headers.c>
SetEnvIf Origin "http(s)?://(www\.)?(audio.coptic-treasures.com|video.coptic-treasures.com|text.coptic-treasures.com)$" AccessControlAllowOrigin=$0$1
Header add Access-Control-Allow-Origin %{AccessControlAllowOrigin}e env=AccessControlAllowOrigin
Header set Access-Control-Allow-Credentials true

But it did not work. I get the following error:

XMLHttpRequest cannot load https://coptic-treasures.com/wp-json/frm/v2/forms/6?return=html. The 'Access-Control-Allow-Origin' header contains multiple values 'https://audio.coptic-treasures.com, https://audio.coptic-treasures.coms', but only one is allowed. Origin 'https://audio.coptic-treasures.com' is therefore not allowed access.

I do not have a duplication of any urls.

Then I read in the W3.org article regarding CORS, section 6.4 the following:

Resources that wish to enable themselves to be shared with multiple Origins but do not respond uniformly with "*" must in practice generate the Access-Control-Allow-Origin header dynamically in response to every request they wish to allow. As a consequence, authors of such resources should send a Vary: Origin HTTP header or provide other appropriate control directives to prevent caching of such responses, which may be inaccurate if re-used across-origins.

I appreciate any help in implementing the w3.org recommendations.

Also, I don't currently have any caching or CDN, but in the live site, both will be active.

Thanks in advance.

  • @Mark. Thanks for your comprehensive comment. I have a form that has thousand of entries and I want to use it in 5 subdomains, it is not efficient to keep updateing 5 forms. I started this project based on the plugin developer documentation that the forms can be shown on many sites. But if it will post security risk, then I will have to go through the exercise of building the 5 forms in parallel and keep updating the entries in parallel. I am not familiar with server to server rest api. Thanks for highlighting the potential of such big security concern.
    – Atef Wagih
    Commented Oct 14, 2016 at 10:12
  • hmm deleted my previous comment as it seemed to be too much about the previous question :( anyway, why not an iframe? Commented Oct 14, 2016 at 10:18
  • and obviously, you can try asking the author, if they say something can be done they have probably more experiance with it than most other people Commented Oct 14, 2016 at 10:21
  • The forms process data from its thousands of entries. I will try an iframe and see the results. As for the developers, I contacted them, but they gave me the wildcard code that will open my website to the whole webheader("Access-Control-Allow-Origin: *");
    – Atef Wagih
    Commented Oct 14, 2016 at 10:24


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.