title: Express CORS subdomain
body: <p>I have a site —<code>https://example.com</code>— that makes calls to an API —<code>https://api.example.com</code>—. The API is written in Express, and its using <a href="https://www.npmjs.com/package/cors" rel="nofollow noreferrer">CORS package</a> to allow the requests from the site:</p>
  
  <pre><code>app.use(
      cors({
          credentials: true,
          origin: "https://example.com",
      })
  );
  </code></pre>
  
  <p>The site can be accessed via <code>https://example.com</code> or via <code>https://www.example.com</code>. As you see, in the API am allowing explicitly the requests coming from the former address, but not from the latter. So if anyone access it via the latter address the requests to the API will be rejected.</p>
  
  <p>What is the usual way to solve that? Allow explicitly both <code>https://example.com</code> and <code>https://www.example.com</code>? Or maybe there is a way to ignore the subdomain <code>www</code>?</p>
  
  <p>Thanks in advance!</p>
  
  <p>-- </p>
  
  <p>EDIT:</p>
  
  <p>As proposed I added <code>https://www.example.com</code> explicitly to the cors configuration</p>
  
  <pre><code>app.use(
      cors({
          credentials: true,
          origin: ["https://example.com", "https://www.example.com"],
      })
  );
  </code></pre>
  
  <p>But this didn't work. As a workaround what I just did is to redirect with a rewrite condition in <code>.htaccess</code> file —Apache server— from <code>www</code> domain to non <code>www</code> domain. </p>
  
  <p>But the question now is: why even allowing <code>www.example.com</code> didnt work? Is there any common reason for that?</p>