为了对. net应用程序进行相当简单的复制/粘贴，我写这个代码是从全局变量中启用CORS。asax文件。这段代码遵循当前接受的回答中给出的建议，将请求中给出的任何原点反映到响应中。这有效地实现了'*'而不使用它。

这样做的原因是它支持多种其他CORS功能，包括发送带有'withCredentials'属性设置为'true'的AJAX XMLHttpRequest的能力。

void Application_BeginRequest(object sender, EventArgs e)
{
    if (Request.HttpMethod == "OPTIONS")
    {
        Response.AddHeader("Access-Control-Allow-Methods", "GET, POST");
        Response.AddHeader("Access-Control-Allow-Headers", "Content-Type, Accept");
        Response.AddHeader("Access-Control-Max-Age", "1728000");
        Response.End();
    }
    else
    {
        Response.AddHeader("Access-Control-Allow-Credentials", "true");

        if (Request.Headers["Origin"] != null)
            Response.AddHeader("Access-Control-Allow-Origin" , Request.Headers["Origin"]);
        else
            Response.AddHeader("Access-Control-Allow-Origin" , "*");
    }
}

Django中还有一个答案。要让一个视图允许来自多个域的CORS，以下是我的代码:

def my_view(request):
    if 'HTTP_ORIGIN' in request.META.keys() and request.META['HTTP_ORIGIN'] in ['http://allowed-unsecure-domain.com', 'https://allowed-secure-domain.com', ...]:
        response = my_view_response() # Create your desired response data: JsonResponse, HttpResponse...
        # Then add CORS headers for access from delivery
        response["Access-Control-Allow-Origin"] = request.META['HTTP_ORIGIN']
        response["Access-Control-Allow-Methods"] = "GET" # "GET, POST, PUT, DELETE, OPTIONS, HEAD"
        response["Access-Control-Max-Age"] = "1000"  
        response["Access-Control-Allow-Headers"] = "*"  
        return response

对于多个域，在你的。htaccess:

<IfModule mod_headers.c>
    SetEnvIf Origin "http(s)?://(www\.)?(domain1.example|domain2.example)$" AccessControlAllowOrigin=$0$1
    Header add Access-Control-Allow-Origin %{AccessControlAllowOrigin}e env=AccessControlAllowOrigin
    Header set Access-Control-Allow-Credentials true
</IfModule>

PHP代码:

$httpOrigin = isset($_SERVER['HTTP_ORIGIN']) ? $_SERVER['HTTP_ORIGIN'] : null;
if (in_array($httpOrigin, [
    'http://localhost:9000', // Co-worker dev-server
    'http://127.0.0.1:9001', // My dev-server
])) header("Access-Control-Allow-Origin: ${httpOrigin}");
header('Access-Control-Allow-Credentials: true');

我有同样的问题与woff字体，多子域必须有访问。为了允许子域，我在我的httpd.conf中添加了这样的东西:

SetEnvIf Origin "^(.*\.example\.com)$" ORIGIN_SUB_DOMAIN=$1
<FilesMatch "\.woff$">
    Header set Access-Control-Allow-Origin "%{ORIGIN_SUB_DOMAIN}e" env=ORIGIN_SUB_DOMAIN
</FilesMatch>

对于多个域，您可以更改SetEnvIf中的正则表达式。

只能为Access-Control-Allow-Origin标头指定一个原点。但是您可以根据请求在响应中设置原点。不要忘记设置Vary标头。在PHP中，我将做以下工作:

/**
 * Enable CORS for the passed origins.
 * Adds the Access-Control-Allow-Origin header to the response with the origin that matched the one in the request.
 * @param array $origins
 * @return string|null returns the matched origin or null
*/
function allowOrigins($origins)
{
    $val = $_SERVER['HTTP_ORIGIN'] ?? null;
    if (in_array($val, $origins, true)) {
        header('Access-Control-Allow-Origin: '.$val);
        header('Vary: Origin');
        
        return $val;
    }
        
    return null;
}
    
if (allowOrigins(['http://localhost', 'https://localhost'])) {
   echo your response here, e.g. token
}