I am using [ServiceStack](https://www.servicestack.com) with [SharpPages](https://sharpscript.net/) to render dynamic content. For "reasons", I need to set the CORS headers `Access-Control-Allow-Origin` and `Access-Control-Allow-Credentials`, supporting multiple subdomains.

My SharpPages feature is enabled with :

```
var pagesFeature = new SharpPagesFeature()
        {
            ScriptMethods = { new UrlScriptMethods(), new DbScriptsAsync() },
        };
        pagesFeature.Args[ServiceStack.Script.ScriptConstants.DefaultDateFormat] = "MM/dd/yyyy hh:mm";
        pagesFeature.Args[ServiceStack.Script.ScriptConstants.DefaultDateTimeFormat] = "MM/dd/yyyy hh:mm";
        Plugins.Add(pagesFeature);

```

I'm hosting on IIS, so I could use web.config like below, but I can only specify one domain this way. If I specify multiple, `XMLHttpRequest` calls complain there are multiple domains set for that header.

```
<system.webServer>
  <httpProtocol>
    <customHeaders>
      <add name="Access-Control-Allow-Origin" value="https://subdomain.domain.com" />
    </customHeaders>
  </httpProtocol>
</system.webServer>

```

Likewise, I could have used the ServiceStack `HostConfig` property `GlobalResponseHeaders`, but same deal. 

I've even tried ServiceStack `PreRequestFilters`, but those aren't called unless a service method is called. Here is my filter:

```
this.PreRequestFilters.Add((httpReq, httpResp) =>
        {
            var origin = httpReq.Headers.Get(HttpHeaders.Origin);
            if (!string.IsNullOrWhiteSpace(origin))
            {
                httpResp.AddHeader(HttpHeaders.AllowOrigin, origin);
                httpResp.AddHeader(HttpHeaders.AllowCredentials, "true");
            }
        });

```

Finally, `StaticFileHandler.ResponseFilter` won't work, since I'm using a view engine and not static files.

So, how can I add custom response headers to View Pages (SharpPages in particular, possibly Razor pages as well) in `ServiceStack`?

The raw request is below. Interesting that I'm requesting `https://computer.domain` but FireFox translates that to `localhost`. Regardless, the `favicon.ico` request DOES get trapped by the filter. The request below DOES NOT.

```
GET /forms/newsletter HTTP/1.1
Host: localhost:44308
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:67.0) Gecko/20100101 Firefox/67.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Cookie: ss-pid=wCR4INmjLXpBnbsBoe2n
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

```

The raw response is :

```
HTTP/2.0 200 OK
cache-control: private
content-type: text/html
content-encoding: gzip
vary: Accept-Encoding
server: Microsoft-IIS/10.0
x-aspnet-version: 4.0.30319
x-sourcefiles: =?UTF-8?B?QzpcVXNlcnNcamtsZW1tYWNrXFNvdXJjZVxSZXBvc1xPQlJDX0JNU1xCTVMuV2ViLkJvdHRsZURyb3BDZW50ZXJzXEJNUy5XZWIuQm90dGxlRHJvcENlbnRlcnNcZm9ybXNcbmV3c2xldHRlcg==?=
x-powered-by: ASP.NET
access-control-allow-origin: *
date: Tue, 11 Jun 2019 16:28:34 GMT
content-length: 862
X-Firefox-Spdy: h2

```