--- a/plugins/mod_http.lua	Sat Jun 10 12:14:12 2023 +0200
+++ b/plugins/mod_http.lua	Sat Jun 10 12:33:58 2023 +0200
@@ -149,7 +149,7 @@
 		local app_credentials = opt_credentials;
 		local app_origins;
 		if opt_origins and not (opt_origins:empty() or opt_origins:contains("*")) then
-			opt_origins = opt_origins._items;
+			app_origins = opt_origins._items;
 		end
 
 		local function cors_handler(event_data)