Access Control Allow Origin: client request to (www.client.url) What is returned by the server?

Access Control Allow Origin: client request to (www.client.url) What is returned by the server?

• A. ACAO client.url
• B. Access-Control-Allow-Origin: *
• C. Access-Control-Allow-Methods: GET
• D. Origin: www.client.url

Answer: (A)

In CORS, the server communicates whether a cross-origin request is allowed by returning a header called Access-Control-Allow-Origin in its response. The value of this header typically echoes back the exact origin of the requesting client (or uses a wildcard to allow all origins, depending on the server’s policy). Since the request comes from www.client.url, the server would respond with Access-Control-Allow-Origin: http://www.client.url (or https://www.client.url), indicating that that specific origin is permitted. That’s why the correct idea is that the server returns the ACAO header containing the client’s origin. The other options aren’t what the server would return in this scenario: a wildcard ACAO: * would permit any origin but isn’t specific to the requesting client; a header naming the allowed methods is a separate piece of information; and Origin is a header the client sends, not something the server returns as a response header.

In CORS, the server communicates whether a cross-origin request is allowed by returning a header called Access-Control-Allow-Origin in its response. The value of this header typically echoes back the exact origin of the requesting client (or uses a wildcard to allow all origins, depending on the server’s policy). Since the request comes from www.client.url, the server would respond with Access-Control-Allow-Origin: http://www.client.url (or https://www.client.url), indicating that that specific origin is permitted.

That’s why the correct idea is that the server returns the ACAO header containing the client’s origin. The other options aren’t what the server would return in this scenario: a wildcard ACAO: * would permit any origin but isn’t specific to the requesting client; a header naming the allowed methods is a separate piece of information; and Origin is a header the client sends, not something the server returns as a response header.