AMP Access Control Allow Source Origin header Issue

Although OP uses PHP, I'm posting here for my javascript peeps.

For node express server, you can use amp-toolbox-cors, which provides middleware.

const express = require('express');
const ampCors = require('amp-toolbox-cors');

const app = express();

// That's it!
app.use(ampCors());
...

By default, the AMP CORS middleware will only allow requests from AMP Caches listed on https://cdn.ampproject.org/caches.json (with the addition of bing-amp.com).

All other origins will receive a 403 response.

So for localhost or dev testing, you guys will probably want to also add the following:

app.use(ampCors({
  verifyOrigin: false
}));

For those who want to take a deeper dive, here's a link to offical docs on how to comply with AMP CORS.

This may save a head ache or two. I went round in circles quite a while;

Be aware in the recognized answer above that if https://example.com happens to be a domain name with hyphens in it, the string replacement will not give the desired result.

For example https://www.my-domain.com needs to be turned into https://www-my--domain-com and it won't be.

header("Access-Control-Allow-Origin: ". str_replace('.', '-','https://www.my-domain.com') .".cdn.ampproject.org");

Needs to be

header("Access-Control-Allow-Origin: https://www-my--domain.com.cdn.ampproject.org");

So

$h = 'https://www.my-domain.com';
$h = str_replace('-', '--',$h);
$h = str_replace('.', '-',$h).'.cdn.ampproject.org';

then

header("Access-Control-Allow-Origin: " . $h);