Another question regarding the CORS spec: 1. Why would a browser report multiple Origins to the web server?
2. http://www.w3.org/TR/access-control/#resource-requests Why does the spec prescribe "match any" instead of "match all" when multiple origin values are received? Shouldn't the server app determine whether AND or OR matching is more appropriate? Vladimir -- Vladimir Dzhuvinov :: software.dzhuvinov.com