@@ -75,29 +75,29 @@ clients).
7575
7676** 1)** When the ` Origin ` header is set:
7777
78- 1 . Client (browser) loads an app from ` https://app.org ` and wants to send an XHR
79- (ajax) request to the server at ` https://example.org ` . Before sending the
78+ 1 . Client (browser) loads an app from ` https://app.example ` and wants to send an XHR
79+ (ajax) request to the server at ` https://server.example ` . Before sending the
8080 request over the wire, the browser adds the ` Origin ` header: `Origin:
81- https://app.org ` , which corresponds to the domain from where the app was loaded.
81+ https://app.example ` , which corresponds to the domain from where the app was loaded.
8282
83- 2 . The server running on https://example.org receives the request and looks at the
84- ` Origin ` header. It sees ` https://app.org ` , stores the value and handles the
83+ 2 . The server running on ` https://server.example ` receives the request and looks at the
84+ ` Origin ` header. It sees ` https://app.example ` , stores the value and handles the
8585 request.
8686
87873 . The server responds to the request and sets the value of the request ` Origin `
8888 header to the CORS header in the HTTP response:
8989
9090``` http
91- Access-Control-Allow-Origin: https://app.org
91+ Access-Control-Allow-Origin: https://app.example
9292```
9393
9494** 2)** Without an ` Origin ` header:
9595
96- 1 . A curl request is sent from the terminal to ` https://example.org ` . Unless
96+ 1 . A curl request is sent from the terminal to ` https://server.example ` . Unless
9797 explicitly specified though a curl parameter, the ` Origin ` header will not be
9898 set.
9999
100- 2 . The server running on ` https://example.org ` receives the request and does not
100+ 2 . The server running on ` https://server.example ` receives the request and does not
101101 find an ` Origin ` header.
102102
1031033 . The server responds to the request and sets a default "all" value for the
0 commit comments