--- a/web/webconfig.py	Wed Mar 12 16:02:44 2014 +0100
+++ b/web/webconfig.py	Fri Mar 14 11:20:53 2014 +0100
@@ -247,6 +247,36 @@
           'help': 'The static data resource directory path.',
           'group': 'web', 'level': 2,
           }),
+        ('access-control-allow-origin',
+         {'type' : 'csv',
+          'default': (),
+          'help':('comma-separated list of allowed origin domains or "*" for any domain'),
+          'group': 'web', 'level': 2,
+          }),
+        ('access-control-allow-methods',
+         {'type' : 'csv',
+          'default': (),
+          'help': ('comma-separated list of allowed HTTP methods'),
+          'group': 'web', 'level': 2,
+          }),
+        ('access-control-max-age',
+         {'type' : 'int',
+          'default': None,
+          'help': ('maximum age of cross-origin resource sharing (in seconds)'),
+          'group': 'web', 'level': 2,
+          }),
+        ('access-control-expose-headers',
+         {'type' : 'csv',
+          'default': (),
+          'help':('comma-separated list of HTTP headers the application declare in response to a preflight request'),
+          'group': 'web', 'level': 2,
+          }),
+        ('access-control-allow-headers',
+         {'type' : 'csv',
+          'default': (),
+          'help':('comma-separated list of HTTP headers the application may set in the response'),
+          'group': 'web', 'level': 2,
+          }),
         ))
 
     def __init__(self, *args, **kwargs):