Enable CORS on subdirectories under /var/www on Apache
<p>I'm trying to enable CORS for a subdirectory on my site, after reading that using a wildcard for domain on the root folder can be a security risk.</p>

<p>This is part of my apache2.conf, the unsafe wildcard on root folder.</p>

<pre><code>&lt;Directory /var/www/&gt;
     Options Indexes FollowSymLinks
     AllowOverride None
     Require all granted
     &lt;IfModule mod_headers.c&gt;
             Header set Access-Control-Allow-Origin "*"
     &lt;/IfModule&gt;
&lt;/Directory&gt;
</code></pre>

<p>Is there a way I can get CORS enabled only for a subdirectory of var/www?</p>

<p>I need to remove the </p>

<pre><code>'Header set Access-Control-Allow-Origin "*"'
</code></pre>

<p>from var/www, but when I try to do:</p>

<pre><code>&lt;Directory /var/www/subdir/&gt;
     Options Indexes FollowSymLinks
     AllowOverride None
     Require all granted
     &lt;IfModule mod_headers.c&gt;
             Header set Access-Control-Allow-Origin "*"
     &lt;/IfModule&gt;
&lt;/Directory&gt;
</code></pre>

<p>I get an error in Chrome telling me</p>

<pre><code>No 'Access-Control-Allow-Origin' header is present on the requested resource.
</code></pre>

<p>Is there a way to get the CORS enabled for subfolder and not for root?
Thanks.</p>