Question: I have a question about CORS through php:

I found this php script, right [here](https://stackoverflow.com/questions/8719276/cors-with-php-headers) on stackoverflow:

```
 <?php
// Allow from any origin
if (isset($_SERVER['HTTP_ORIGIN'])) {
    header("Access-Control-Allow-Origin: {$_SERVER['HTTP_ORIGIN']}");
    header('Access-Control-Allow-Credentials: true');
    header('Access-Control-Max-Age: 86400');    // cache for 1 day
}

// Access-Control headers are received during OPTIONS requests
if ($_SERVER['REQUEST_METHOD'] == 'OPTIONS') {

    if (isset($_SERVER['HTTP_ACCESS_CONTROL_REQUEST_METHOD']))
        header("Access-Control-Allow-Methods: GET, POST, OPTIONS");         

    if (isset($_SERVER['HTTP_ACCESS_CONTROL_REQUEST_HEADERS']))
        header("Access-Control-Allow-Headers:        {$_SERVER['HTTP_ACCESS_CONTROL_REQUEST_HEADERS']}");

    exit(0);
}

echo "You have CORS!";?>

```

-And it totally works, so that's great!

But I would like it, so only one specific site get permission to access the server - how would I go about that?

// rephrased:  

what I mean, is that I want to be able to make "b\_site.com" access the server, and fonts, of "a\_site.com". The script I posted above does enable that, but it enables it for every excisting site ever. I want it to be enabled exclusively to "b\_site.com".

I'm all new to php, and have spent hours trying to figure this out - I would really appreciate some help.

Thanks in advance!

//updated the title to "(...)site" instead of "(...)url" for clarity.

Answer: 
Have you tried

```
Access-Control-Allow-Origin: http://b_site.com

if (isset($_SERVER['HTTP_ORIGIN']) && $_SERVER['HTTP_ORIGIN'] == 'http://www.b_site.com') {
    header("Access-Control-Allow-Origin: {$_SERVER['HTTP_ORIGIN']}");
    header('Access-Control-Allow-Credentials: true');
    header('Access-Control-Max-Age: 86400');    // cache for 1 day

```

}
Try this:

```
$http_origin = $_SERVER['HTTP_HOST'];

if ($http_origin == "www.b_site.com" OR $http_origin == "b_site.com")
{  
    header("Access-Control-Allow-Origin: $http_origin");
}

```