ckan/ckan — pull request #2004 by brew (2014-10-27 17:19:42+00:00)
Title: Access-Control-Allow CORS settings in config

Relating to #1944, a couple of config settings to control the Access-Control-Allow-Origin response header. To repeat the commit message:

> New config settings:
> ckan.cors.origin_allow_all = \
> ckan.cors.origin_whitelist = \

> Access-Control-Allow headers will only be set in the response if the request contains an Origin header, the origin_allow_all setting is present, and either:

> a) the origin_allow_all setting is true, or
> b) the request origin is listed in the origin_whitelist setting

These will be sent for all responses that fit the above criteria. Do we want to restrict A-C-A-O to just api requests?