title: Best method: Access-Control-Allow-Origin Multiple Origin Domains
body: <p>This question has been asked on here before and given an array of good answers, mainly: 
  <a href="https://stackoverflow.com/questions/1653308/access-control-allow-origin-multiple-origin-domains">Access-Control-Allow-Origin Multiple Origin Domains?</a></p>
  
  <p>However there seems to be a gap in explanation in terms of the approved method that should be undertaken. Reading through the W3 documentation we have what appears to me to be a conflict of guidance. </p>
  
  <p>Firstly we see the answer given as the <em>right</em> way to do it in a lot of the previous answers which dictates that the host server must dynamically echo back the the given 'Origin' if it appears on a predefined 'whitelist'.
  <a href="http://www.w3.org/TR/cors/#resource-implementation" rel="noreferrer">http://www.w3.org/TR/cors/#resource-implementation</a></p>
  
  <p>However a lot of the answers and methods used also allude to a space delimited list which can also be used as a method of passing multiple 'Origins' to allow. If we take a look at another piece of W3 documentation at <a href="http://www.w3.org/wiki/CORS_Enabled" rel="noreferrer">http://www.w3.org/wiki/CORS_Enabled</a> we see an example of this in the first section of the page as: </p>
  
  <pre><code> Access-Control-Allow-Origin: http://example.com:8080 http://blah.example.com http://foo.example.com
  </code></pre>
  
  <p>Of these two methods I would be equally happy to incorparate either however there may be a large list of URLs which will need to be whilelisted and so I wanted to ensure that I am doing this corrently first time round. If anyone has any insight into the two methods mentioned above I would be very grateful to hear the decision in your choices and if there is a definitive guide to the recommended method I may have missed.</p>