title: CORS issue using AWS Cloudfront with Signed Cookies. AllowedOrigin not getting set to what is passed in the Header
body: <p>To give context how this is different from the other question (for which this has been marked duplicate.</p>
  
  <p>The application on <a href="https://subdomain.domain.com" rel="nofollow noreferrer">https://subdomain.domain.com</a> is in PHP and it creates the signed cookie and sends to the client. Along with the cookie I have tried setting the header (have also tried without setting this header)<br>
  header("Access-Control-Allow-Origin: <a href="https://subdomain.domain.com" rel="nofollow noreferrer">https://subdomain.domain.com</a>");</p>
  
  <p>Expected behaviour: 
  <code>Access-Control-Allow-Origin : https://subdomain.domain.com</code> <br>
  Actual behaviour: 
  <code>Access-Control-Allow-Origin : *</code></p>
  
  <p>If in s3 I set CORS to <code>&lt;AllowedOrigin&gt;https://subdomain.domain.com&lt;/AllowedOrigin&gt;</code> 
  things are fine. But I will also be accessing this from subdomain2 and subdomain3. </p>
  
  <p>So how to I change the origin based on context?</p>
  
  <p>Rest remains the same to give more context to the reader:<br>
  ++++++++</p>
  
  <p>Access-Control-Allow-Origin is not getting set to the correct origin '<a href="https://subdomain.domain.com" rel="nofollow noreferrer">https://subdomain.domain.com</a>'  <br/></p>
  
  <blockquote>
    <p>On Safari (on Mac) everything is fine and the video plays properly.  <br/>
    On Chrome and Firefox I get the following error</p>
    
    <p>Access to XMLHttpRequest at '<a href="https://media.domain.com/folder/part1/part1.m3u8" rel="nofollow noreferrer">https://media.domain.com/folder/part1/part1.m3u8</a>' from origin '<a href="https://subdomain.domain.com" rel="nofollow noreferrer">https://subdomain.domain.com</a>' has been blocked by CORS policy: The value of the 'Access-Control-Allow-Origin' header in the response must not be the wildcard '*' when the request's credentials mode is 'include'. The credentials mode of requests initiated by the XMLHttpRequest is controlled by the withCredentials attribute. </p>
  </blockquote>
  
  <p>I have setup a an s3 bucket with the required CORS configuration. The Cloudfront distribution whitelists Origin, Access-Control-Allow-Origin &amp; Access-Control-Allow-Methods. "Forward Cookies" is set to all. </p>
  
  <p>The signed cookie is set for the a folder which contains .m3u8 and .ts files</p>
  
  <blockquote>
    <ol>
    <li>s3</li>
    </ol>
  </blockquote>
  
  <pre class="lang-xml prettyprint-override"><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;CORSConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/"&gt;
  &lt;CORSRule&gt;
      &lt;AllowedOrigin&gt;*&lt;/AllowedOrigin&gt;
      &lt;AllowedMethod&gt;GET&lt;/AllowedMethod&gt;
      &lt;AllowedMethod&gt;HEAD&lt;/AllowedMethod&gt;
      &lt;MaxAgeSeconds&gt;3000&lt;/MaxAgeSeconds&gt;
      &lt;AllowedHeader&gt;*&lt;/AllowedHeader&gt;
  &lt;/CORSRule&gt;
  &lt;/CORSConfiguration&gt;
  </code></pre>
  
  <blockquote>
    <ol start="2">
    <li>CF .<br/></li>
    </ol>
  </blockquote>
  
  <p>CNAME: media.domain.com <br/>
  Custom Wildcard SSL: *.domain.com  <br/> </p>
  
  <p>Two origins:  <br/>
  subdomain.domain.com  <br/>
  s3 bucket  <br/></p>
  
  <p>Three behaviours:  <br/></p>
  
  <ol>
   <li>default - points to subdomain.domain.com</li>
   <li>*.m3u8 - points to the s3 bucket</li>
   <li>*.ts - points to the s3 bucket</li>
  </ol>
  
  <blockquote>
    <ol start="3">
    <li>JWPlayer</li>
    </ol>
  </blockquote>
  
  <pre class="lang-js prettyprint-override"><code>withCredentials: 'true',
  onXhrOpen: function(xhr, url) {                                            
      xhr.setRequestHeader("Access-Control-Allow-Headers","Content-Type, Accept, X-Requested-With");
      xhr.setRequestHeader("Access-Control-Allow-Origin","https://subdomain.domain.com");
      xhr.setRequestHeader("Access-Control-Allow-Credentials","true");
  }
  </code></pre>
  
  <blockquote>
    <p>Request &amp; Response</p>
  </blockquote>
  
  <pre><code>General:
  
  Request URL: https://media.domain.com/folder/part1/part1.m3u8
  Request Method: GET
  Status Code: 200 
  Remote Address: 54.230.71.77:443
  Referrer Policy: no-referrer-when-downgrade
  
  Response Headers:
  accept-ranges: bytes
  access-control-allow-methods: GET, HEAD
  access-control-allow-origin: *
  access-control-expose-headers: ETag
  access-control-max-age: 3000
  age: 9566
  content-length: 686
  content-type: application/x-mpegURL
  date: Wed, 11 Sep 2019 09:32:35 GMT
  etag: "626d2a3acf31a80ed709de0ddaf8e9a6"
  last-modified: Fri, 06 Sep 2019 07:52:42 GMT
  server: AmazonS3
  status: 200
  vary: Origin,Access-Control-Request-Headers,Access-Control-Request-Method
  via: 1.1 5324246cfb52c8bfaf71104a45e6ce53.cloudfront.net (CloudFront)
  x-amz-cf-id: LJ9F80PYJsSXkl-QO-nKFrRdqK8Hsy6Hc8dZ49t75bsx6u9RFmspzw==
  x-amz-cf-pop: BLR50-C1
  x-cache: Hit from cloudfront
  
  Request Headers:
  Provisional headers are shown
  Origin: https://subdomain.domain.com
  Referer: https://subdomain.domain.com/test/testcfurl
  Sec-Fetch-Mode: cors
  User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.132 Safari/537.36
  </code></pre>
  
  <p>On Safari (on Mac) the requested video plays fine.  <br/>
  Chrome and Firefox gives and error "The value of the 'Access-Control-Allow-Origin' header in the response must not be the wildcard '*' when the request's credentials mode is 'include'"</p>
  
  <p>Any help is appreciated.
  Have tried out everything mention in <a href="https://stackoverflow.com/questions/44960944/hls-js-cors-using-aws-cloudfront-issues-with-cookies">hls.js CORS using AWS Cloudfront issues with Cookies</a></p>