@HovercraftFullOfEels Sorry, my bad. It shouldn't be on meta but I think this question would be better in other stack exchange sites maybe (Information Security, Web Applications or Software Engineering) given that it is not a question related to a particular code or issue but more related to the CORS mechanism internals. — JGuarate 12 secs ago