HTTP headers
Access-Control-Allow-Origin HTTP Header Meaning
Access-Control-Allow-Origin says which origin may read the response.
Meaning
The server is granting browser CORS access to a specific origin or wildcard.
Where it appears
Servers send it on CORS responses when browser JavaScript should be allowed to read the result.
What to check
Check wildcard use, credentialed requests, and whether the allowed origin is reflected safely.
Example
Access-Control-Allow-Origin: https://app.example