Multiple cors origins on hosted discourse?

If the origin of the request matches one of the listed origins, then we return that as the allowed CORS origin.

So it should already be working for you.