Read Access-Control-Allow-Origin as a sharing decision

The useful distinctions

• Access-Control-Allow-Origin controls cross-origin response sharing.
• An explicit value names one origin.
• A wildcard cannot authorize credentialed cross-origin response sharing.

Identify the origin being compared

An origin includes a scheme, host, and relevant port. It does not include a page's path. In the synthetic example the allowed browser application is identified by a single HTTPS origin. Keeping that value separate from a media URL prevents errors such as placing an entire playlist path into an origin field. The response excerpt also shows variation on Origin so that dynamically selected sharing decisions can be represented in caching analysis.

Keep sharing and permission separate

A server can return an HTTP response that browser code is not permitted to read. That distinction explains why a network panel and a script can appear to disagree without establishing a media-decoder fault. Conversely, allowing a browser origin to read a response does not authenticate a user or grant a subscription. An implementation review should therefore inspect resource authorization and browser sharing as distinct decisions. Do not attempt to fix a denial by weakening unrelated policies. The synthetic excerpt contains no cookies or credentials and illustrates only response metadata; it does not claim that a real browser request, preflight, or player operation has succeeded. A useful authoring fixture pairs one allowed origin with one deliberately different origin. Compare the declared policy for each case without pretending that a successful text comparison is a browser execution test.

Worked example · synthetic

This valid response-field excerpt names one fictional application origin. There is no trailing slash or path in the origin value, and it supplies no account access.

Synthetic text example; no network operation has been performed.

HTTP/MIME line endings are CRLF. Request URL context, where labelled, is commentary rather than a wire field. No message was transmitted.

Access-Control-Allow-Origin: https://viewer.example.invalid
Vary: Origin

Check the interpretation

• Compare scheme, host, and port.
• Do not put a path in an origin value.
• Review credentialed cases separately from wildcard sharing.