@@ -75,29 +75,29 @@ clients).
75
75
76
76
** 1)** When the ` Origin ` header is set:
77
77
78
- 1 . Client (browser) loads an app from ` https://app.org ` and wants to send an XHR
79
- (ajax) request to the server at ` https://example.org ` . Before sending the
78
+ 1 . Client (browser) loads an app from ` https://app.example ` and wants to send an XHR
79
+ (ajax) request to the server at ` https://server.example ` . Before sending the
80
80
request over the wire, the browser adds the ` Origin ` header: `Origin:
81
- https://app.org ` , which corresponds to the domain from where the app was loaded.
81
+ https://app.example ` , which corresponds to the domain from where the app was loaded.
82
82
83
- 2 . The server running on https://example.org receives the request and looks at the
84
- ` Origin ` header. It sees ` https://app.org ` , stores the value and handles the
83
+ 2 . The server running on ` https://server.example ` receives the request and looks at the
84
+ ` Origin ` header. It sees ` https://app.example ` , stores the value and handles the
85
85
request.
86
86
87
87
3 . The server responds to the request and sets the value of the request ` Origin `
88
88
header to the CORS header in the HTTP response:
89
89
90
90
``` http
91
- Access-Control-Allow-Origin: https://app.org
91
+ Access-Control-Allow-Origin: https://app.example
92
92
```
93
93
94
94
** 2)** Without an ` Origin ` header:
95
95
96
- 1 . A curl request is sent from the terminal to ` https://example.org ` . Unless
96
+ 1 . A curl request is sent from the terminal to ` https://server.example ` . Unless
97
97
explicitly specified though a curl parameter, the ` Origin ` header will not be
98
98
set.
99
99
100
- 2 . The server running on ` https://example.org ` receives the request and does not
100
+ 2 . The server running on ` https://server.example ` receives the request and does not
101
101
find an ` Origin ` header.
102
102
103
103
3 . The server responds to the request and sets a default "all" value for the
0 commit comments