Better document use of the credentials flag

[cyu]

Better document use of the credentials flag

[singfoom]

I apologize if this is the wrong place to ask this, but I'm having this exact issue and I wanted to ask...
This is my block for the cors configuration, adding the subdomains like your applications above, as well as some localhosts for development in different apps...

    config.middleware.use Rack::Cors do
      allow do
        origins 'http://subdomain1.foo.com', 'http://localhost:3000', 'http://localhost:63342', 'http://localhost', 'http://subdomain2.foo.com'
        resource '*', 
          :headers => :any, 
          :methods => [:get, :post, :options, :delete, :put]
      end
    end

I don't think it's a good solution to use "*" as the origin as I only want my API accessible to the apps that are authorized to use it. Yet, looking at the CORS spec, it will only return one URL at a time. So what's the solution to allow multiple origins to hit the same Rack::CORS enabled service? I saw the previous issue of #30 which had a comment suggesting the use of *.domain.com to address this.

What's the best way to address this in the config?

UPDATE (same day):

I have this 95% solved by setting the :max_age => 0. That avoids caching the Allow-Access-Control-Origin when you switch from one internal app to another. Leaving this here in case someone else has the same problem.

That said, the '*.subdomain.foo" had the effect of not working for any of the subdomains...