# CORS Settings - all subdomains

**URL:** <https://discourse.haproxy.org/t/cors-settings-all-subdomains/560>\
**Category:** Help!\
**Created:** [August 12, 2016, 10:22am UTC](https://discourse.haproxy.org/t/cors-settings-all-subdomains/560 "2016-08-12T10:22:21Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![latitude](https://avatars.discourse-cdn.com/v4/letter/l/41988e/32.png) [@latitude](https://discourse.haproxy.org/u/latitude)\
**Post date:** [August 12, 2016, 10:22am UTC](https://discourse.haproxy.org/t/cors-settings-all-subdomains/560/1 "2016-08-12T10:22:21Z")

</div>

Hello HAProxy Community!

I need a little assistance with CORS configuration.

I need to allow CORS from all subdomains on a domain, e.g. \*.domain.com. I currently have the following config:

capture request header origin len 128  
http-response add-header Access-Control-Allow-Origin %[capture.req.hdr(0)] if { capture.req.hdr(0) -m found }  
rspadd Access-Control-Allow-Headers:\ Origin,\ X-Requested-With,\ Content-Type,\ Accept if { capture.req.hdr(0) -m found }

But I believe this allows wide open CORS. Is there a way to limit it to all subdomains on a domain?

Using HAProxy version 1.5.18

Thanks in advance!

---

<div class="post-metadata">

**Author:** ![avoinea](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.haproxy.org/avoinea/32/636_2.png) [@avoinea](https://discourse.haproxy.org/u/avoinea)\
**Post date:** [September 27, 2018, 7:05am UTC](https://discourse.haproxy.org/t/cors-settings-all-subdomains/560/2 "2018-09-27T07:05:45Z")

</div>

Replace:

> [@latitude](#):
>
> http-response add-header Access-Control-Allow-Origin %[capture.req.hdr(0)] if { capture.req.hdr(0) -m found }

with:

`http-response add-header Access-Control-Allow-Origin %[capture.req.hdr(0)] if { capture.req.hdr(0) -m end domain.com }`