+#trusted-cgi-referer http://www.example.org/local-privoxy-control-page
+#
+# 4.11. cors-allowed-origin
+# ==========================
+#
+# Specifies:
+#
+# A trusted website which can access Privoxy's CGI pages through
+# JavaScript.
+#
+# Type of value:
+#
+# URL
+#
+# Default value:
+#
+# Unset
+#
+# Effect if unset:
+#
+# No external sites get access via cross-origin resource
+# sharing.
+#
+# Notes:
+#
+# Modern browsers by default prevent cross-origin requests made
+# via JavaScript to Privoxy's CGI interface even if Privoxy
+# would trust the referer because it's white listed via the
+# trusted-cgi-referer directive.
+#
+# Cross-origin resource sharing (CORS) is a mechanism to allow
+# cross-origin requests.
+#
+# The "cors-allowed-origin" option can be used to specify a
+# domain that is allowed to make requests to Privoxy CGI
+# interface via JavaScript. It is used in combination with the
+# trusted-cgi-referer directive.
+#
+# +-----------------------------------------------------+
+# | Warning |
+# |-----------------------------------------------------|
+# |Declaring domains the admin doesn't control |
+# |trustworthy may allow malicious third parties to |
+# |modify Privoxy's internal state against the user's |
+# |wishes and without the user's knowledge. |
+# +-----------------------------------------------------+