/**
 * CORS middleware
 *
 * @param {Object} [settings]
 * @return {Function}
 * @api public
 */
module.exports = function(settings) {

  var defaults = {
    origin: '*',
    methods: 'GET,HEAD,PUT,POST,DELETE'
  };

  settings = settings || defaults;

  return function* cors(next) {

    var options = {
      origin:      settings.origin || defaults.origin,
      methods:     settings.methods || defaults.methods,
      credentials: settings.credentials,
      headers:     settings.headers,
      expose:      settings.expose,
      maxAge:      settings.maxAge
    };

    if (typeof options.origin === 'function') {
      options.origin = options.origin(this.request);
    }

    /**
     * Access Control Allow Origin
     */
    if (options.origin === false) {
      return;
    } else if (options.origin === true) {
      options.origin = this.header.origin || '*';
    } else if (!options.origin) {
      options.origin = '*';
    }
    this.set('Access-Control-Allow-Origin', options.origin);

    /**
     * Access Control Expose Headers
     */
    if (options.expose) {
      if (options.expose.join) {
        options.expose = options.expose.join(',');
      }
      if (options.expose.length) {
        this.set('Access-Control-Expose-Headers', options.expose);
      }
    }

    /**
     * Access Control Max Age
     */
    options.maxAge = options.maxAge && options.maxAge.toString();
    if (options.maxAge && options.maxAge.length) {
      this.set('Access-Control-Max-Age', options.maxAge);
    }

    /**
     * Access Control Allow Credentials
     */
    if (options.credentials === true) {
      this.set('Access-Control-Allow-Credentials', 'true');
    }

    /**
     * Access Control Allow Methods
     */
    if (options.methods.join) {
      options.methods = options.methods.join(',');
    }
    this.set('Access-Control-Allow-Methods', options.methods);

    /**
     * Access Control Allow Headers
     */
    if (!options.headers) {
      options.headers = this.header['access-control-request-headers'];
    } else if (options.headers.join) {
      options.headers = options.headers.join(',');
    }
    if (options.headers && options.headers.length) {
      this.set('Access-Control-Allow-Headers', options.headers);
    }

    /**
     * Returns
     */
    if (this.method === 'OPTIONS') {
      this.status = 204;
    } else {
      yield next;
    }

  }

};

@@ -160,19 +160,219 @@
 origin: 
-'*'
+function(req) %7B%0A      // http://www.w3.org/TR/cors/#supports-credentials%0A      // #3 %22The string %22*%22 cannot be used for a resource that supports credentials.%22%0A      return req.header.origin %7C%7C '*';%0A    %7D
 ,%0A    me
@@ -985,32 +985,33 @@
 %0A    %7D else if (
+!
 options.origin =
@@ -1009,33 +1009,18 @@
 .origin 
-=== true) %7B%0A     
+%7C%7C
  options
@@ -1032,90 +1032,57 @@
 in =
+==
  t
-his.header.origin %7C%7C '*';%0A    %7D else if (!options.origin) %7B%0A      option
+rue) %7B%0A      options.origin = default
 s.origin
  = '
@@ -1081,14 +1081,8 @@
 igin
- = '*'
 ;%0A  

Return origin by default instead of wildcard http://www.w3.org/TR/cors/#supports-credentials The string "*" cannot be used for a resource that supports credentials.