The HTTP headers used by the cross-origin resource sharing protocol identify trusted web origins and associated features such whether authorised access is allowed. In a header exchange between a browser and the cross-origin web site that it is attempting to access, these are merged.