ping @Hainish will there be a new release any time soon given that #15157 and #15411 are merged?

thanks again @cschanaj for all of your work on https-e!

According to https://www.w3.org/TR/cors/#access-control-allow-origin-response-header

In practice the origin-list-or-null production is more constrained. Rather than allowing a space-separated list of origins, it is either a single origin or the string "null".

and according to https://tools.ietf.org/html/rfc6454#section-7.1

   The Origin header field has the following syntax:

   origin              = "Origin:" OWS origin-list-or-null OWS
   origin-list-or-null = %x6E %x75 %x6C %x6C / origin-list
   origin-list         = serialized-origin *( SP serialized-origin )
   serialized-origin   = scheme "://" host [ ":" port ]
                       ; <scheme>, <host>, <port> from RFC 3986

There is only a single Origin in the Access-Control-Allow-Origin header, consisting of scheme, host and an optional port only.

What if one of the URLs has http: in the middle?

So, I guess this cannot happen in reality.

@Hainish could you please help to confirm?

Thanks @cschanaj. This sounds correct to me. Merging.

@Hainish Thanks for merging this PR. We don't have any full release since April, is there is plan to make a release soon?