yada

borkdude 2017-10-04T13:08:30.000593Z

Can I configure :allow-origin to allow all subdomains from a certain domain?

borkdude 2017-10-04T13:09:46.000008Z

or should I use a function of the ctx and look at the request headers?

dominicm 2017-10-04T13:44:03.000447Z

@borkdude https://developer.mozilla.org/en-US/docs/Web/HTTP/Access_control_CORS "*" is valid for that header

borkdude 2017-10-04T14:04:36.000465Z

I know, but what about not allowing other domains?

borkdude 2017-10-04T14:09:29.000265Z

Ah, it also supports a vector (looked at the tests), that’s good enough for me

dominicm 2017-10-04T14:09:57.000183Z

I'm betting *.http://foo.com would work