···5353 }
5454 }
55555656- // allow JavaScript code to access responses (including errors) even across origins
5757- w.Header().Set("Access-Control-Allow-Origin", "*")
5656+ if r.Header.Get("Origin") != "" {
5757+ // allow JavaScript code to access responses (including errors) even across origins
5858+ w.Header().Set("Access-Control-Allow-Origin", "*")
5959+ }
58605961 if sitePath == ".git-pages" {
6062 // metadata directory name shouldn't be served even if present in site manifest