title: Enable Access-Control-Allow-Origin for multiple domains in Node.js
body: <p>I'm trying to allow CORS in node.js but the problem is that I can't set <code>*</code> to <code>Access-Control-Allow-Origin</code> if <code>Access-Control-Allow-Credentials</code> is set.</p>
  <p>Also the specification said I can't do an array or comma separated value for <code>Access-Control-Allow-Origin</code> and the suggested method would be to do something similar to this <a href="https://stackoverflow.com/questions/1653308/access-control-allow-origin-multiple-origin-domains">Access-Control-Allow-Origin Multiple Origin Domains?</a></p>
  <p>But I can't seem to do this way in node.js</p>
  <pre><code>[&quot;http://example.com:9001&quot;, &quot;http://example.com:5001&quot;].map(domain =&gt; {
    res.setHeader(&quot;Access-Control-Allow-Origin&quot;, domain);
  });
  res.header(&quot;Access-Control-Allow-Credentials&quot;, true);
  </code></pre>
  <p>The problem here is that it's bein override by the last value in the array, so the header will be set to       <code>res.setHeader(&quot;Access-Control-Allow-Origin&quot;, &quot;http://example.com:5001&quot;);</code></p>
  <p>Error from the client browser:</p>
  <blockquote>
  <p>XMLHttpRequest cannot load <a href="http://example.com:9090/api/sync" rel="noreferrer">http://example.com:9090/api/sync</a>. The
  'Access-Control-Allow-Origin' header has a value
  'http://example.com:5001' that is not equal to the supplied origin.
  Origin 'http://example.com:9001' is therefore not allowed access.</p>
  </blockquote>