When implementing Cross Origin Resource Sharing  you will find ample advice to set your response header as Access-Control-Allow-Origin: * and be done with it This works fine for unauthenticated resources  but what if you want to add CORS support to an authenticated resource? The use cases are much more limited in comparison  but perhaps you have a support ticket system on the Internet you want to query from a platform internal to your team/company  or something along those lines