Answers: <p>CORS is not allowing subdomains, so you need to specify them in your server configuration.</p>
  
  <p>If you are using NGINX (or you could use it as a proxy and solve your problem) by providing dynamic cors header response</p>
  
  <pre><code>
  server {
  
      root /path/to/your/stuff;
  
      index index.html index.htm;
  
       set $cors "";
  
      if ($http_origin ~* (.*\.yoursweetdomain.com)) {
          set $cors "true";
      }
  
      server_name yoursweetdomain.com;
  
      location / {
  
          if ($cors = "true") {
              add_header 'Access-Control-Allow-Origin' "$http_origin";
              add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS, DELETE, PUT';
              add_header 'Access-Control-Allow-Credentials' 'true';
              add_header 'Access-Control-Allow-Headers' 'User-Agent,Keep-Alive,Content-Type';
          }
  
  
          if ($request_method = OPTIONS) {
              return 204;
          }
  
      }
  }
  
  </code></pre>
  
  <p><a href="http://rustyrazorblade.com/post/2013/2013-10-31-cors-with-wildcard-domains-and-nginx/" rel="nofollow noreferrer">Source here</a></p>
  
Answers: CC BY-SA 4.0
Answers: 2019-08-21T12:28:45.103Z
Answers: 2019-08-21T12:28:45.103Z
Answers: profesor79
Body: <p>Will CORS ever be a problem when you have x.example.com going to y.example.com or only if the root domain is different?</p>
  
Tags: <amazon-web-services><cors>
Title: CORS and subdomains - do subdomains matter?
UserDisplayName: Alexander Mills
ThreadText: # CORS and subdomains - do subdomains matter?
  
  (Asked by: username_0 on 2019-08-20)
  
  Will CORS ever be a problem when you have x.example.com going to y.example.com or only if the root domain is different?
  
  **Tags:** amazon-web-services, cors
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2019-08-21. Score: 4
  
  CORS is not allowing subdomains, so you need to specify them in your server configuration.
  
  If you are using NGINX (or you could use it as a proxy and solve your problem) by providing dynamic cors header response
  
  ```
  
  server {
  
      root /path/to/your/stuff;
  
      index index.html index.htm;
  
       set $cors "";
  
      if ($http_origin ~* (.*\.yoursweetdomain.com)) {
          set $cors "true";
      }
  
      server_name yoursweetdomain.com;
  
      location / {
  
          if ($cors = "true") {
              add_header 'Access-Control-Allow-Origin' "$http_origin";
              add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS, DELETE, PUT';
              add_header 'Access-Control-Allow-Credentials' 'true';
              add_header 'Access-Control-Allow-Headers' 'User-Agent,Keep-Alive,Content-Type';
          }
  
          if ($request_method = OPTIONS) {
              return 204;
          }
  
      }
  }
  
  ```
  
  [Source here](http://rustyrazorblade.com/post/2013/2013-10-31-cors-with-wildcard-domains-and-nginx/)
  
  
  ---
  
  