ottoyiu/django-cors-headers — pull request #14 by scdoshi (2013-07-06 02:41:13+00:00)
Title: Change behaviour of CORS_ORIGIN_ALLOW_ALL

If setting:

CORS_ORIGIN_ALLOW_ALL = True

response should limit the allowed origins to that request's origin, which would be much safer than using '*'' while still allowing all origins.

To keep compatibility with the old mode, using '*' for the setting will set allowed origins header to '*'.

CORS_ORIGIN_ALLOW_ALL = '*'