Access-Control-Allow-Headers does not allow Range

[nickdesaulniers]

Hi there, big fan of http-server. I'm trying to use it to serve content locally for testing MSE with DASH which makes heavy use of HTTP Byte Range Requests. It look like blink based browsers complain that "XMLHttpRequest cannot load http://localhost:8000/audio_128k.webm. Request header field Range is not allowed by Access-Control-Allow-Headers."

I run http-server with the --cors flag. The DASH libraries I'm testing both seem to send HTTP OPTIONS requests to the assets to check the response headers (preflight). It looks like http-server is responding with the following headers: "Access-Control-Allow-Headers:Origin, X-Requested-With, Content-Type, Accept"

So I think Range would have to be added to the list. I'm curious, is there a reason why not all headers are whitelisted with the asterisk as a value?