{"action":"created","issue":{"url":"https://api.github.com/repos/remotestorage/spec/issues/92","labels_url":"https://api.github.com/repos/remotestorage/spec/issues/92/labels{/name}","comments_url":"https://api.github.com/repos/remotestorage/spec/issues/92/comments","events_url":"https://api.github.com/repos/remotestorage/spec/issues/92/events","html_url":"https://github.com/remotestorage/spec/issues/92","id":110733496,"number":92,"title":"Rationale for disallowing wildcards in CORS GET headers","user":{"login":"untitaker","id":837573,"avatar_url":"https://avatars.githubusercontent.com/u/837573?v=3","gravatar_id":"","url":"https://api.github.com/users/untitaker","html_url":"https://github.com/untitaker","followers_url":"https://api.github.com/users/untitaker/followers","following_url":"https://api.github.com/users/untitaker/following{/other_user}","gists_url":"https://api.github.com/users/untitaker/gists{/gist_id}","starred_url":"https://api.github.com/users/untitaker/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/untitaker/subscriptions","organizations_url":"https://api.github.com/users/untitaker/orgs","repos_url":"https://api.github.com/users/untitaker/repos","events_url":"https://api.github.com/users/untitaker/events{/privacy}","received_events_url":"https://api.github.com/users/untitaker/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":4,"created_at":"2015-10-09T20:49:28Z","updated_at":"2015-10-13T09:05:42Z","closed_at":null,"body":">For GET requests, a wildcard\r\n    origin MAY be returned, but for PUT and DELETE requests, **the\r\n    response MUST echo back the Origin header sent by the client**.\r\n\r\nWhy are wildcards explicitly disallowed here? It'd be nice to include the rationale for that in the spec."},"comment":{"url":"https://api.github.com/repos/remotestorage/spec/issues/comments/147654581","html_url":"https://github.com/remotestorage/spec/issues/92#issuecomment-147654581","issue_url":"https://api.github.com/repos/remotestorage/spec/issues/92","id":147654581,"user":{"login":"fkooman","id":616885,"avatar_url":"https://avatars.githubusercontent.com/u/616885?v=3","gravatar_id":"","url":"https://api.github.com/users/fkooman","html_url":"https://github.com/fkooman","followers_url":"https://api.github.com/users/fkooman/followers","following_url":"https://api.github.com/users/fkooman/following{/other_user}","gists_url":"https://api.github.com/users/fkooman/gists{/gist_id}","starred_url":"https://api.github.com/users/fkooman/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/fkooman/subscriptions","organizations_url":"https://api.github.com/users/fkooman/orgs","repos_url":"https://api.github.com/users/fkooman/repos","events_url":"https://api.github.com/users/fkooman/events{/privacy}","received_events_url":"https://api.github.com/users/fkooman/received_events","type":"User","site_admin":false},"created_at":"2015-10-13T09:05:41Z","updated_at":"2015-10-13T09:05:41Z","body":"Where exactly in the CORS spec? I was actually looking for it yesterday, it seems to allow to always specify `*`*."}}