h5bp/server-configs-nginx — pull request #23 by geedew (2013-11-21 16:10:05+00:00)
Title: Updating the configuration for cross-domain

The biggest issue that's here is that * is being used which will allow any domain to use XHR connections to your domain. This opens up many security issues as it breaks the same-domain model built into the browser. It's suggested that users instead whitelist domains they wish to give connections to.