Re: [whatwg/fetch] Cache-Friendly Access-Control-Allow-Origin (#890)

That syntax was not for what you think it was for. If a user agent made a request and that request went via multiple cross-origin redirects, the user agent could list all the origins in the `Origin` header with that syntax. And the response to that request would have to echo the exact value. However, all user agents decided to treat that as `null` instead as "stack" inspection was deemed insecure. There never was a feature to allow requests from multiple origins with a single static value (other than `*`).

So, to answer your questions:

1. It was never implemented.
2. They return an error because it doesn't match the `Origin` header of the request.
3. Because space-separated meant something else and more importantly comma-separated is the standard syntax for multi-value HTTP headers.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/890#issuecomment-513159620