bravepickle

# Handling CORS headers for handling cross-origin requests example
# See https://developer.mozilla.org/en/docs/Web/HTTP/CORS
# TODO: check if origin is set. If missing then do not add CORS headers
# TODO: handle ports in origin

# check if origin header is among allowed ones
map $http_origin $cors_origin {
    hostnames;

    # all domains and subdomains for my-site.com or *.my-site.com can request contents