nelmio/NelmioCorsBundle — comment on commit fb243ace83c55280d8a7841a0fbaf22a4e947600
File: EventListener/Kernel.php line 116
By Seldaek:

As far as I can tell from the spec, the [cache is per origin](http://dvcs.w3.org/hg/cors/raw-file/tip/Overview.html#preflight-result-cache), so I prefer to avoid leaking potentially sensitive information - the list of allowed origins would just tell an attacker where he should look for vulnerabilities to do CSRF attacks on our API. If the origin is '*' though we could send that back.