I want to configure my Apache 2.4 to serve some static resources in a CORS-friendly way. I already have the following setting:
Header always set Access-Control-Allow-Origin "*"
However, for recent Safari this appears to not be enough:
[Error] Failed to load resource: Request header field … is not allowed by
Fields mentioned in this fashion include
DNT, but I guess after adding them I might also be seeing
Accept-Language, since these are the ones mentioned in the
Access-Control-Request-Headers header sent by Safari. But who is to tell me what other headers Safari or some other browser might be requesting, now or in a future, for myself or for some other user with a different configuration? Apparently
* is not a valid setting for the
Access-Control-Allow-Headers header, for reasons I don't really understand.
So how do I configure a server to just say “use this resources anywhere, I don't care about CORS for them”?