skip to Main Content

Before you tell me about Access-Control-Allow-Origin and whitelisting, assume for the sake of argument that I can’t touch the HTTP headers.

This is a hypothetical question.


My question:

  • let’s say I have an app available at a domain and I want to send a POST request from another domain, but I own both domains.
  • let’s also say, for the sake of argument, that I’m not at liberty to adjust CORS settings

So I can make an ajax request from website.com to app.website.com. but I have a second website, website2.com, which would also like to make an ajax request to app.website.com

If I were to create two CNAME records for app.website.com so that app.website2.com would point to the same app, could I then make an ajax request from either domain without necessitating the setting of Access-Control headers?

As far as I can tell, the only problem would be a possible SEO penalty from Google for not having a canonical URL for app.website.com, which is irrelevant as in my thought experiment it’s basically just an endpoint.

Anybody illuminate me?

2

Answers


  1. The Same-Origin Policy judges by hostname (as part of the origin), not physical server.

    You can’t do that.

    To put it differently, if you use shared hosting, you must not get access to anyone else on that shared server.

    Instead, you can use JSONP.

    Login or Signup to reply.
  2. If you comply to the same hostname restriction (including the subdomain) then you can indeed use a CNAME to allow both domains to point to the same server.

    If your question is about whether the name resolution of the CNAME is of importance for the CORS, then answer is “no it is not considered” and thus you can use this trick.

    Login or Signup to reply.
Please signup or login to give your own answer.
Back To Top
Search