can only specify one origin in cors

rest/handlers.go

@@ -1,26 +1,24 @@
 package rest
 
-import (
-	"net/http"
-	"strings"
-)
+import "net/http"
 
 const (
 	allowOrigin  = "Access-Control-Allow-Origin"
-	allOrigin    = "*"
+	allOrigins   = "*"
 	allowMethods = "Access-Control-Allow-Methods"
 	allowHeaders = "Access-Control-Allow-Headers"
 	headers      = "Content-Type, Content-Length, Origin"
 	methods      = "GET, HEAD, POST, PATCH, PUT, DELETE"
-	separator    = ", "
 )
 
+// CorsHandler handles cross domain OPTIONS requests.
+// At most one origin can be specified, other origins are ignored if given.
 func CorsHandler(origins ...string) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if len(origins) > 0 {
-			w.Header().Set(allowOrigin, strings.Join(origins, separator))
+			w.Header().Set(allowOrigin, origins[0])
 		} else {
-			w.Header().Set(allowOrigin, allOrigin)
+			w.Header().Set(allowOrigin, allOrigins)
 		}
 		w.Header().Set(allowMethods, methods)
 		w.Header().Set(allowHeaders, headers)