* The ``++Access-Control-Allow-Origin++`` header should be set only for a trusted origin and for specific resources.
* Allow only selected, trusted domains in the ``++Access-Control-Allow-Origin++`` header. Prefer whitelisting domains over blacklisting or allowing any domain (do not use * wildcard nor blindly return the ``++Origin++`` header content without any checks).
