Anycompany has several applications that need to load images and fonts from www.anycompany.com. Users are currently getting CORS errors. How should…

In PingAccess you grant CORS access by listing the domains that are allowed to make the browser request. Setting Allowed Origins to “.anycompany.com” matches every application that sits on a sub-domain of anycompany.com, so every needed app can obtain the images and fonts from www.anycompany.com. Because the resources are static, cookies are not required; therefore Allow Credentials should be left disabled. This combination satisfies security guidelines (no credentials are exposed) while meeting the CORS specification that “” may be used only when Allow Credentials = false.

A. Requires enumerating every single app domain; scalable but not simpler than a single wildcard and still no credentials.

C. Violates CORS spec—“” cannot be returned when Allow Credentials is true; browsers reject the response.

D. Returns Access-Control-Allow-Origin: www.anycompany.com, which does not match the calling applications’ origins, so the browser still blocks the request.

1. Ping Identity, “PingAccess Server 10.0 Administration Guide,” Section “Add a Cross-Origin Resource Sharing rule,” pp. 277-278: Allowed Origins may use a sub-domain wildcard (.example.com); “” is valid only when Allow Credentials is not selected.

2. Ping Identity, “PingAccess Server 8.3 Administration Guide,” Table “CORS Rule Fields,” p. 249: “If Allow Credentials is selected the Access-Control-Allow-Origin header cannot be .”

3. MIT OpenCourseWare, 6.858 Computer Systems Security (Fall 2014), Lecture 4 notes, “Browser Same-Origin Policy and CORS,” para. 8: credentials are unnecessary for public static resources and should be disabled for security.