Is Access-Control-Allow-Origin in response header case-sensitive?
html, http-headers, httprequest, httpresponse, javascript
Solution
No, the header is not case-sensitive.
Your problem is simpler: the `Access-Control-Allow-*` headers only affect the site that the header appears on. A header sent by Site B can only grant access by scripts to Site B; it cannot grant access to a separate Site A.
If you want to access Site A from a script running on Site B, you will need to have Site A add `Access-Control-Allow-*` headers, or find another solution that doesn't involve accessing it from a script.
Problem
I want to access content of site A, from site B. So, I config the Access-Control-Allow-Origin of site B to wildcard (*). However, after the configuration I will got cross-origin exception. Then, I try to curl the site A url, and get this result: ``` access-control-allow-headers: * access-control-allow-origin: * ``` So, I am not sure is it because the keyword Access-Control-Allow-Origin is case sensitive? I tried to search around, cannot find any doc specify that it must be camel case. Updated: Let me explain what really happens to me: I have site B (https://siteB.com) which has a iframe with src="https://siteA.com". On site B, I have a script to get dynamic height for that iframe: `function showPageDialog(url, id, title, onCloseDialog) { var iframe = $('<iframe/>', {'class': 'frame', 'src': url}).load(function(){ setTimeout(function() { $(iframe).height($(iframe).contents().height()); }, 100); }); showDialog(iframe, id, title, onCloseDialog); }` This function got exception when access $(iframe).contents(), the exception detail as follow: ``` Uncaught DOMException: Failed to read the 'contentDocument' property from 'HTMLIFrameElement': Blocked a frame with origin "https://siteB.com" from accessing a cross-origin frame. ``` Here is the curl result: ``` HTTP/1.1 200 OK Server: Apache ETag: "f8daec99fedb6b0cd0d205598167cf11:1477550373" Last-Modified: Thu, 27 Oct 2016 06:39:33 GMT Accept-Ranges: bytes Content-Length: 44152 Content-Type: text/html Date: Mon, 31 Oct 2016 09:14:19 GMT Connection: keep-alive access-control-allow-headers: * access-control-allow-origin: * ``` As mentioned in @duskwuff's answer, I alr had `Access-Control-Allow-*` in the response header from siteA. But still get exception.