An HTTP Cloud Function receives metrics from a separate application web origin. Which Access-Control-Allow-Origin header value allows only that application to post metrics?

The Access-Control-Allow-Origin header specifies which origins are permitted to access the resource. To allow only a specific application to post metrics, you must set this header to the exact origin of that application. This ensures that only requests originating from that precise domain are allowed, preventing Cross-Origin Resource Sharing (CORS) errors for legitimate requests while blocking unauthorized ones. Setting Access-Control-Allow-Origin: would allow any origin to access the Cloud Function, which is insecure and defeats the purpose of restricting access. Using a wildcard for all application subdomains would be too broad if the goal is to restrict to a single, specific application. The Cloud Function's own origin is irrelevant here, as the request is coming from the separate application to the Cloud Function.