Conversation

The weirdest thing to me about CORS is that you can't whitelist multiple sites in the same Access-Control-Allow-Origin header. It's either "*" or exactly one site.

So the standard solution is to echo back the referrer site, but only if it's whitelisted. "Ah yes foo.com, you are my one and only. I only allow requests from you." "Ah yes bar.com, you are my one and only. I only allow..." It's bizarre.