<p>CORS is not allowing subdomains, so you need to specify them in your server configuration.</p>

<p>If you are using NGINX (or you could use it as a proxy and solve your problem) by providing dynamic cors header response</p>

<pre><code>
server {

    root /path/to/your/stuff;

    index index.html index.htm;

     set $cors "";

    if ($http_origin ~* (.*\.yoursweetdomain.com)) {
        set $cors "true";
    }

    server_name yoursweetdomain.com;

    location / {

        if ($cors = "true") {
            add_header 'Access-Control-Allow-Origin' "$http_origin";
            add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS, DELETE, PUT';
            add_header 'Access-Control-Allow-Credentials' 'true';
            add_header 'Access-Control-Allow-Headers' 'User-Agent,Keep-Alive,Content-Type';
        }


        if ($request_method = OPTIONS) {
            return 204;
        }

    }
}

</code></pre>

<p><a href="http://rustyrazorblade.com/post/2013/2013-10-31-cors-with-wildcard-domains-and-nginx/" rel="nofollow noreferrer">Source here</a></p>

CC BY-SA 4.0
2019-08-21T12:28:45.103Z
2019-08-21T12:28:45.103Z
profesor79
<p>Will CORS ever be a problem when you have x.example.com going to y.example.com or only if the root domain is different?</p>

<amazon-web-services><cors>
CORS and subdomains - do subdomains matter?
Alexander Mills
# CORS and subdomains - do subdomains matter?

(Asked by: username_0 on 2019-08-20)

Will CORS ever be a problem when you have x.example.com going to y.example.com or only if the root domain is different?

**Tags:** amazon-web-services, cors


---

## 1 answers

### Answer by username_1 on 2019-08-21. Score: 4

CORS is not allowing subdomains, so you need to specify them in your server configuration.
If you are using NGINX (or you could use it as a proxy and solve your problem) by providing dynamic cors header response

server {

    root /path/to/your/stuff;

    index index.html index.htm;

     set $cors "";

    if ($http_origin ~* (.*\.yoursweetdomain.com)) {
        set $cors "true";
    }

    server_name yoursweetdomain.com;

    location / {

        if ($cors = "true") {
            add_header 'Access-Control-Allow-Origin' "$http_origin";
            add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS, DELETE, PUT';
            add_header 'Access-Control-Allow-Credentials' 'true';
            add_header 'Access-Control-Allow-Headers' 'User-Agent,Keep-Alive,Content-Type';
        }


        if ($request_method = OPTIONS) {
            return 204;
        }

    }
}


Source here


---

