3 ms·
Realistically, Dynamic Allow-Origin is the only way when you want to add more than a few allowed Origins. You wouldn't want to send back a 10kb header detailing
by blackflame7000 7y ago
Realistically, Dynamic Allow-Origin is the only way when you want to add more than a few allowed Origins. You wouldn't want to send back a 10kb header detailing all the clients of your service, would you?
- politician 7y agoCall it a bug in the spec if you want, but regardless the spec provides no guidance about whether reflecting the Origin is a good workaround.
- blackflame7000 7y agoYou shouldn’t reflect the origin unless it matches your whitelist. If you wanted to allow all you would just use *. If its not allowed you should return invalid headers instead. Thats why its dynamic