Actually, headers _do_ often work that way. HTTP says: Multiple message-header fields with the same field-name MAY be present in a message if and only if the e

Actually, headers _do_ often work that way. HTTP says: Multiple message-header fields with the same field-name MAY be present in a message if and only if the entire field-value for that header field is defined as a comma-separated list Which applies to HTTP headers such as Cache-Control:, and probably goes back to the email RFCs allowing multiple To: headers. It's just that Access-Control-Allow-Origin isn't defined to accept a comma list, just like Content-Security-Policy doesn't (which is another header breaking things if it appears more than once)