@coronin we just investigated and found out that AllowCorsFrom only supports a single domain name
We have a bug ticket to fix it here: https://mattermost.atlassian.net/browse/PLT-6393
Sorry about that, let us know if you're hitting any issues with this bug..