allowOrigin property

List<String> allowOrigin
final

The allowed origins (Access-Control-Allow-Origin).

  • Empty (the default): the request Origin is reflected, preserving the behavior of servers configured before this entry existed.
  • Not empty: an allowlist. The request Origin is reflected only when it matches an entry, otherwise no Access-Control-Allow-Origin is sent and the browser blocks the cross-origin read. An entry * allows any origin.

Note that reflecting any origin together with allowCredentials lets any site perform credentialed calls to this API and read the responses: the browser only rejects that pairing for a literal *. An allowlist here is the fix.

Implementation

final List<String> allowOrigin;