# How to allow origin header for multiple sites?

**URL:** <https://discourse.getcockpit.com/t/how-to-allow-origin-header-for-multiple-sites/1204>\
**Category:** General\
**Created:** [February 9, 2020, 2:55pm UTC](https://discourse.getcockpit.com/t/how-to-allow-origin-header-for-multiple-sites/1204 "2020-02-09T14:55:47Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![ronaldaug](https://yyz2.discourse-cdn.com/flex030/user_avatar/discourse.getcockpit.com/ronaldaug/32/260_2.png) [@ronaldaug](https://discourse.getcockpit.com/u/ronaldaug)\
**Post date:** [February 9, 2020, 2:55pm UTC](https://discourse.getcockpit.com/t/how-to-allow-origin-header-for-multiple-sites/1204/1 "2020-02-09T14:55:47Z")

</div>

Actually, I’m not familiar with .yaml extension.  
I tried to add the config as below

```auto
cors:
allowedOrigins: - https://domainone.com
                - https://domaintwo.com

```

But it’s showing the error like this

`The 'Access-Control-Allow-Origin' header contains the invalid value 'Array'.`

---

<div class="post-metadata">

**Author:** ![pauloamgomes](https://yyz2.discourse-cdn.com/flex030/user_avatar/discourse.getcockpit.com/pauloamgomes/32/48_2.png) [@pauloamgomes](https://discourse.getcockpit.com/u/pauloamgomes)\
**Post date:** [February 12, 2020, 10:03pm UTC](https://discourse.getcockpit.com/t/how-to-allow-origin-header-for-multiple-sites/1204/2 "2020-02-12T22:03:02Z")

</div>

That will not work, you can specify in the configuration only one entry. If you check the index.php:

```auto
    $_cors = $cockpit->retrieve('config/cors', []);

    header('Access-Control-Allow-Origin: ' .($_cors['allowedOrigins'] ?? '*'));

```

so unless @artur accept a change for that (and not sure if that make sense), you may need to deal with it in the webserver, check for a solution here: [https://stackoverflow.com/a/11077890](https://stackoverflow.com/a/11077890)

---

<div class="post-metadata">

**Author:** ![artur](https://yyz2.discourse-cdn.com/flex030/user_avatar/discourse.getcockpit.com/artur/32/4_2.png) [@artur](https://discourse.getcockpit.com/u/artur)\
**Post date:** [February 13, 2020, 12:15am UTC](https://discourse.getcockpit.com/t/how-to-allow-origin-header-for-multiple-sites/1204/3 "2020-02-13T00:15:57Z")

</div>

please consider using `config.php` instead of `config.yaml`:

```php
<?php

return [

  'cors' => [

    'allowedOrigins' => in_array($_SERVER['HTTP_ORIGIN'], ['https://domainone.com', 'https://domaintwo.com']) 
                        ? $_SERVER['HTTP_ORIGIN'] : 'https://domainone.com'
  ]

];

```

if you use the php based configuration, then you’re more flexible (eg using env variables for dynamic config)

---

<div class="post-metadata">

**Author:** ![ronaldaug](https://yyz2.discourse-cdn.com/flex030/user_avatar/discourse.getcockpit.com/ronaldaug/32/260_2.png) [@ronaldaug](https://discourse.getcockpit.com/u/ronaldaug)\
**Post date:** [February 13, 2020, 5:25am UTC](https://discourse.getcockpit.com/t/how-to-allow-origin-header-for-multiple-sites/1204/4 "2020-02-13T05:25:41Z")

</div>

Thanks @pauloamgomes and @artur I comment off the `Access-Control-Allow-Origin` and `Access-Control-Allow-Methods` lines in index.php and add in .htaccess as below.

```auto
<IfModule mod_headers.c>
    SetEnvIf Origin "http(s)?://(domainone.com|domaintwo.com$" AccessControlAllowOrigin=$0
    Header add Access-Control-Allow-Origin %{AccessControlAllowOrigin}e env=AccessControlAllowOrigin
    Header always set Access-Control-Allow-Methods: "GET,POST,OPTIONS,DELETE,PUT"
</IfModule>

```

It’s working now. Thanks

---

<div class="post-metadata">

**Author:** ![hilyin](https://avatars.discourse-cdn.com/v4/letter/h/8c91f0/32.png) [@hilyin](https://discourse.getcockpit.com/u/hilyin)\
**Post date:** [September 21, 2022, 1:58am UTC](https://discourse.getcockpit.com/t/how-to-allow-origin-header-for-multiple-sites/1204/5 "2022-09-21T01:58:03Z")

</div>

Hello,

I am running into this same issue. I am using cockpit within docker, my issue is I am getting CORS errors on imagery I link to in the cockpit stored assets.

I get the error in Chrome browser: `Access to image at 'https://cockpit.example.com/storage/uploads/2022/02/25/image.png' from origin 'https://example.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.`

I noticed in cockpit in index.php:30 (`if (COCKPIT_API_REQUEST)`) the CORS settings are only applying to API requests.

Is there any way to set multiple origins for file assets?

Thank you.