3 ms·

Maybe, but the CORS spec says otherwise. https://www.w3.org/TR/cors/#access-control-allow-origin-response-header https://www.w3.org/TR/cors/#access-control-all

Maybe, but the CORS spec says otherwise. https://www.w3.org/TR/cors/#access-control-allow-origin-response-header https://www.w3.org/TR/cors/#access-control-allow-origin-resp... See the note.

jonstaab 7y ago
Interesting that the spec disagrees with the implementation. Maybe the multi-origin leakage was filed as a bug somewhere and fixed post-spec?