I'm specifying an API for a REST service. The REST service will be primarily accessed by web browsers using XHR requests running code hosted from remote origins. Therefore, I'll need to add CORS support, such as the Access-Control-Allow-Origin header to allow for XSS.

Should I add CORS headers to non-200 responses, such as 400, 401 and 5xx?

  • Sorry if Software Engineering is not the right place (perhaps the reason for the downvote). I can't see a more appropriate StackExchange site. IMHO, SO is too implementation specific. Suggestions for another site welcome. – Alastair McCormack Jan 2 '18 at 10:42
  • I don't know why this question has a down or close vote. It seems on-topic for this site. – Thomas Owens Jan 2 '18 at 11:39
  • 5
    SO dupe: stackoverflow.com/questions/38907385/… – jonrsharpe Jan 2 '18 at 13:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.