Api: JSON component definitions may have incorrect Access-Control-Allow-Origin header cached

[as-com]

See: https://github.com/DestinyItemManager/DIM/issues/5101

tl;dr: Bungie.net appears to return different Access-Control-Allow-Origin headers based on the referrer of the request to a JSON component definition (https://www.bungie.net in some cases and * in others). Whoever is first to warm up the Cloudflare cache will set the Access-Control-Allow-Origin header for the rest of the requests to the Cloudflare PoP, leading to unexpected behavior in third-party applications.

[Achronos-BNG]

This issue is being tracked. We have a short term workaround for when it happens, but we are investigating the root cause.

[Achronos-BNG]

I have located two problems in our CORS processor code that seem to be related, one of which likely outright causes this problem and the other is the reason for why it is intermittent.

[Achronos-BNG]

This should be fixed now.