This is a lot of parameters, and it could grow to even more in the future if supporting e.g. access-control-max-age.  Is it worth collecting them into a separate "CORSPolicy" object to make it easier to manage them?  Just a thought, which could very well turn out ugly in practice :-)