2 ms·
You are right on this - I thought you could set multiple sites by setting multiple headers, but it doesn't work that way, which I should have known because head
by BCharlie 7y ago
You are right on this - I thought you could set multiple sites by setting multiple headers, but it doesn't work that way, which I should have known because headers don't work that way in general...
The recommended way to do multiple sites seems to be to have the server read the request header, check it against a whitelist, then dynamically respond with it, which seems terrible.
Thanks for catching this - I updated the post to reflect this and make it more clear.
- unilynx 7y agoActually, headers _do_ often work that way. HTTP says: Multiple message-header fields with the same field-name MAY be present in a message if and only if the entire field-value for that header field is defined as a comma-separated list Which applies to HTTP headers such as Cache-Control:, and probably goes back to the email RFCs allowing multiple To: headers. It's just that Access-Control-Allow-Origin isn't defined to accept a comma list, just like Content-Security-Policy doesn't (which is another header breaking things if it appears more than once)
- paulddraper 7y agoHeaders usually work exactly that way. Cookies and cors are oddball exceptions