Adjusting reapply_cors logic to return the first match rather than th…

…e specified origin header
Kinto · Nov 21, 2024 · 7221222 · 7221222
1 parent 8e9f42d
commit 7221222
Showing 1 changed file with 3 additions and 2 deletions.
diff --git a/kinto/core/utils.py b/kinto/core/utils.py
@@ -262,8 +262,9 @@ def reapply_cors(request, response):
             settings = request.registry.settings
             allowed_origins = set(aslist(settings["cors_origins"]))
             required_origins = {"*", origin}
-            if allowed_origins.intersection(required_origins):
-                response.headers["Access-Control-Allow-Origin"] = origin
+            matches = allowed_origins.intersection(required_origins)
+            if matches:
+                response.headers["Access-Control-Allow-Origin"] = matches.pop()
 
         # Import service here because kinto.core import utils
         from kinto.core import Service