access-control-allow-origin is always wildcard "*" in XSJS

[former_member655308]

I want to restrict the origin in XSJS to "https://example.com" but even after tsetting the access-control-allow-origin header in the code I still get wildcard "*" in my response.

I have tried setting the allowedOrigin in mta.yaml file and also tried directly in the .xsjs file

In mta.yaml file:

In .xsjs file:

But my response:

I am unable to understand where I am going wrong.

[junwu]

how about

host: "example.com"

[former_member655308]

Tried it but still the same issue.

[junwu]

did you remove the code in your xsjs that set the header?

[former_member655308]

Yes, But I tried with both (Keeping & Removing)