Which header value indicates which origin is allowed to access a resource in cross-origin requests?

Which header value indicates which origin is allowed to access a resource in cross-origin requests?

• A. ACAO client.url
• B. Access-Control-Allow-Origin: *
• C. Origin: client.url
• D. Vary: Origin

Answer: (A)

In cross-origin resource sharing, the server communicates which origin is allowed by sending a response header named Access-Control-Allow-Origin, with the value set to the exact origin that's permitted. So using Access-Control-Allow-Origin: client.url directly states that the specific origin is allowed to access the resource. This is why the option showing that header value is the best choice: it clearly indicates the permitted origin. Using a wildcard, Access-Control-Allow-Origin: *, would allow any origin, which isn’t identifying a specific allowed origin and isn’t appropriate in many scenarios (especially when credentials are involved). The Origin header is what the client sends to tell the server where the request is coming from, not how the server grants access, and Vary: Origin is about caching behavior, not indicating the allowed origin.

In cross-origin resource sharing, the server communicates which origin is allowed by sending a response header named Access-Control-Allow-Origin, with the value set to the exact origin that's permitted. So using Access-Control-Allow-Origin: client.url directly states that the specific origin is allowed to access the resource. This is why the option showing that header value is the best choice: it clearly indicates the permitted origin. Using a wildcard, Access-Control-Allow-Origin: *, would allow any origin, which isn’t identifying a specific allowed origin and isn’t appropriate in many scenarios (especially when credentials are involved). The Origin header is what the client sends to tell the server where the request is coming from, not how the server grants access, and Vary: Origin is about caching behavior, not indicating the allowed origin.