Access-Control-Allow-Origin HTTP header is missing in the response to a CORS (cross-origin resource sharing) preflight, does it mean:
- The server does not support CORS? Or,
- The server denies the access?
If the server does not support CORS, it seems obvious that the header will be missing.
But if it does support CORS, does it mean the access is denied?
And conversely, what should a server which implements CORS do to announce to the client that the access is denied because of CORS? Should it respond with a status like
Every source I found explains which headers are added to allow a cross-domain access but does not explain what to do to deny an access.
** Edit: wrongly asked question, my bad, see explanation below**
The focus of my question seems off-topic compared to what I expected. Indeed an answer is focused on the server configuration but what was interesting to me was the protocol over HTTP.
To be more accurate, I came up with the question because I tried to access a server with a cross request and :
- The server was not including the CORS headers while my XMLHttpRequest was including them
- the browser did accept cross requests done by an
- I checked the referrer of the media and its an iframe was indeed different than the target of the requests
- I did not even know if the server implemented CORS or not
- I do not own the server
My low level of comprehension of CORS inside HTTP and the fact a kind of cross requests were accepted, lead me to wonder if the server was rejecting my requests and what I was doing wrong.
I shall post an answer since I believe I solved it since then.