How do you handle CORS in Apache?

CORS is not a server-side access control mechanism. The browser sends an Origin header, the server decides whether to allow it, and the browser blocks the response if the headers do not match. Non-browser clients ignore CORS entirely, so authentication and authorization still need to be correct on the server.

SetEnvIf Origin "^(https://(app|admin)[.]example[.]com)$" CORS_ORIGIN=$1
Header always set Access-Control-Allow-Origin "%{CORS_ORIGIN}e" env=CORS_ORIGIN
Header always set Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS"
Header always set Access-Control-Allow-Headers "Authorization, Content-Type"
Header always set Access-Control-Allow-Credentials "true"
Header always set Vary "Origin"

RewriteEngine On
RewriteCond %{REQUEST_METHOD} =OPTIONS
RewriteRule ^ - [R=204,L]

Rules that prevent mistakes

• Access-Control-Allow-Origin must be one origin or *, never a list
• Do not combine * with Access-Control-Allow-Credentials: true
• Echo an origin only after matching it against an allowlist
• Send Vary: Origin so caches do not mix responses across origins
• Preflight requests use OPTIONS and need a successful, header-bearing response
• CORS does not protect APIs from curl, scripts or server-to-server calls

For a simple public API, a literal wildcard is fine. For cookie or bearer-token flows, the allowlist must be explicit and the server must reject unknown origins rather than reflecting them. If Apache proxies the API, decide whether Apache or the backend owns CORS headers to avoid duplicates.