Providing Access-Control-Allow-Origin with a wildcard

Question

I am making a page that responds to an AJAX request with a specific string when another specific string is provided as a GET variable. To avoid problems with a policy of the same origin, I found that I can include this PHP line at the top of the page:

header('Access-Control-Allow-Origin: *'); 

No sensitive data is transferred at all, in fact keywords are transferred from several different domains (this is an SEO-related application). Because of this, hundreds of different domains will use it, so if possible, I would like to avoid specifying each of them. Are there any risks to using this line? If so, then who are they?

Also, if this page was located under the HTTPS URL, is it still accessible?

Any advice, suggestions or concerns are welcome. Thanks!

Answer 1

If access is truly public, I would say that this is a good solution. However, if you want to restrict access to your site, you probably want to specify the explicitly permitted domain origin.

Since you say that your answer does not contain confidential information, you probably do not need to worry about hosting your service via HTTPS. The only reason you can do this is if the HTTPS client page is trying to access your non-HTTPS service. In this case, I assume that they will receive a warning about unsafe information sent / received when the AJAX service is called, and possibly even just silence. If this is a common enough case, I would say looking at the HTTPS service. Make sure your HTTPS certificate is certified correctly, because if the client’s browser cannot verify the certificate, the AJAX request will be silent (unlike the prompt when you go directly to the HTTPS page)! In addition, I do not know how this will happen in your case, but whenever I worked with HTTPS, I usually had to configure everything to make them function properly.

In short, I would start with HTTP and then appreciate the need for HTTPS. Good luck