W3C home > Mailing lists > Public > public-webapps@w3.org > July to September 2010

Re: [CORS] Multiple origin values?

From: Anne van Kesteren <annevk@opera.com>
Date: Mon, 27 Sep 2010 14:18:49 +0200
To: "Vladimir Dzhuvinov" <vladimir@dzhuvinov.com>
Cc: public-webapps <public-webapps@w3.org>
Message-ID: <op.vjoxtnzi64w2qv@anne-van-kesterens-macbook-pro.local>
On Mon, 27 Sep 2010 14:10:40 +0200, Vladimir Dzhuvinov  
<vladimir@dzhuvinov.com> wrote:
> Thank you for making this clear to me.
> Multiple origin URLs in "Origin" and "Access-Control-Allow-Origin"
> must be space-separated, correct?


> I'd like to double-check this as the Mozilla docs says
> comma-separated, and they seem to be in error:
> https://developer.mozilla.org/En/HTTP_access_control#section_3
> "...The Access-Control-Allow-Origin header should contain a comma
> separated list of acceptable domains..."

This seems entirely incorrect as the Access-Control-Allow-Origin must  
match the Origin header exactly, octet for octet.

> If space-separated is correct I'll have to correct the docs and
> possibly file a bug report too.

I think redirects might not work yet in Gecko but yeah... I guess I should  
start on a test suite for this at some point...

Anne van Kesteren
Received on Monday, 27 September 2010 12:19:26 UTC

This archive was generated by hypermail 2.4.0 : Friday, 17 January 2020 18:13:11 UTC