Getting access-control-allow-origin as * in AEM cloud publisher domain

[mukeshsingh]

we are in process of migration of project from AMS to cloud in AEM.

while security review , we are getting access-control-allow-origin: * , while accessing the content/dam images, which is a high security issue.

we are not setting this in our dispatcher, but we are still getting this.

Do we have any solution for this.

Guessing is it coming from the internal Fastly's CDN?

[Himanshu_Jain]

Are you using connected assets ? If yes then take a look 

https://experienceleague.adobe.com/docs/experience-manager-cloud-service/content/assets/admin/use-as...

[mukeshsingh]

No we are not using connected assets.

These are simple assets in publish which we are trying to access via publish domain in cloud and getting access-control-allow-origin: *

[Himanshu_Jain]

Can you share the log snippet from console as well as error log from publisher.

[rkmk107]

Any solutions for this, to control allowed origins?

[Himanshu_Jain]

Do you have any custom servlet where you are defining the header ? 

Thanks

[rkmk107]

No Servlet changes, its coming automatically on Assets/images.

[Himanshu_Jain]

Check /clientheader config in aem dispatcher .

Refer : https://experienceleague.adobe.com/docs/experience-manager-learn/foundation/security/understand-cros...

Thanks