title: Allow and configure Access Control Allow Origin
body: <h1>I need to allow access to a page of my site to accept Cross Domain requests from other sites.</h1>
  
  <p>I know this technique is <strong>Cross Origin</strong> or <strong>Cross Domain</strong> or <strong>CORS (Cross-Origin Resource Sharing)</strong>, I have seen several topics that speak of it:</p>
  
  <p><a href="https://stackoverflow.com/questions/12261055/how-to-call-a-page-from-another-domain-to-my-domain-using-ajax-javascript">How to call a page from another domain to my domain using ajax/javascript</a> <br>
  <a href="https://stackoverflow.com/questions/10636611/how-does-access-control-allow-origin-header-work">How does Access-Control-Allow-Origin header work?</a> <br>
  <a href="https://www.html5rocks.com/en/tutorials/cors/" rel="nofollow noreferrer">https://www.html5rocks.com/en/tutorials/cors/</a> <br></p>
  
  <p>But I do not know how to configure my site to allow cross domain queries.</p>
  
  <p>Info: sites that need access to mine do not use browser extensions, so I have to practice cross domain.</p>
  
  <h2>Questions :</h2>
  
  <p><strong>1.</strong> How do I configure the <code>Access-Control-Allow-Origin</code> header? My site is <code>Java-EE</code>, <code>JSF</code> and <code>Spring</code>.</p>
  
  <p><strong>2.</strong> I found two solutions to allow an external site to have the content of my page:</p>
  
  <ul>
  <li><strong>A)</strong> The first solution is a javascript script that generates a link to my page. The external site must then include this link in its page to display the content of my page. (Should I still have <code>Access-Control-Allow-Origin</code> ?)</li>
  </ul>
  
  <p>Example</p>
  
  <pre><code>&lt;script&gt;
          (function (w,i,d,g,e,t,s) 
              w[d] = w[d]||[];
              t= i.createElement(g);
              t.async=1;
              t.src=e;
              s=i.getElementsByTagName(g)[0];
              s.parentNode.insertBefore(t, s);
          })(window, document,'_gscq','script','//widgets.getsitecontrol.com/42540/script.js');
  &lt;/script&gt;
  </code></pre>
  
  <ul>
  <li><p><strong>B)</strong> The second solution is that the external site uses an <code>XMLHttpRequest</code> or <code>AJAX</code> request to load the page of my site :
  <a href="https://stackoverflow.com/questions/8433319/embed-an-external-page-without-an-iframe">Embed an External Page Without an Iframe?</a></p>
  
  <p>What is the best solution (<strong>A</strong> or <strong>B</strong>)? Will the content of the page be loaded in static?</p></li>
  </ul>
  
  <p><strong>3.</strong> Is there a file in the site configuration that allows me to authorize or forbid sites (domains) to access the pages of my site?
  <a href="https://stackoverflow.com/questions/1653308/access-control-allow-origin-multiple-origin-domains">Access-Control-Allow-Origin Multiple Origin Domains?</a></p>
  
  <p>Example</p>
  
  <pre><code>my_page_1.html: // Page of my site
  // Authorize sites to make a cross domain query
  external_site_1.com
  external_site_2.com
  external_site_3.com
  
  my_page_2.html: // Page of my site
  // Authorize sites to make a cross domain query
  external_site_1.com
  
  my_page_3.html: // Page of my site
  // Authorize sites to make a cross domain query
  external_site_1.com
  external_site_3.com
  </code></pre>
  
  <p>Thank you in advance for your answers.</p>