title: CORS and the null origin
body: <p>I have a case where im getting a null returned from a header returned form a CAS server of null</p>
  
  <p>to get over this I added </p>
  
  <pre><code>Header always set Access-Control-Allow-Origin null
  </code></pre>
  
  <p>so now I have</p>
  
  <pre><code>Header always set Access-Control-Allow-Origin *
  
  Header always set Access-Control-Allow-Origin null
  </code></pre>
  
  <p>but now I get objections when i return a non null origin header 
  how can I have both in the Access-Control-Allow-Origin header</p>
  
  <p>is there a way to OR them???</p>
  
  <p>sorry forgot to mention this is in my httpd.conf for the apache server</p>
  
  <p>tried this as well</p>
  
  <pre><code>Header always set Access-Control-Allow-Origin *
  Header add Access-Control-Allow-Origin null
  </code></pre>
  
  <p>actually further investigation reveals</p>
  
  <pre><code>Header always set Access-Control-Allow-Origin *
  Header add Access-Control-Allow-Origin null
  Header add Access-Control-Allow-Origin "https://accp.oursite.com"
  Header add Access-Control-Allow-Origin "http://wwwtest.oursite.com"
  Header add Access-Control-Allow-Origin "http://www.oursite.com"
  </code></pre>
  
  <p>does seem to add to that header not sure if its usable though </p>
  
  <p>and in the response headers I see</p>
  
  <pre><code>Access-Control-Allow-Origin :"*, null, https://accp.oursite.com, http://wwwtest.oursite.com, http://www.oursite.com"
  </code></pre>