Demystifying CORS
This post never actually explains why any of this was needed. The closest it comes is this bit:<p>"If [...] the same-origin policy for XMLHttpRequests relaxed, said services could now receive a deluge of DELETE, PUT, etc… requests from any origin"<p>But why on earth is this a problem? And in any case those services <i>always</i> could receive requests from any origin, browsers aren't the only HTTP clients in the world. In the old days you could simply proxy through a server if you needed to get around the same-origin policy, and I'm sure lots of people did.<p>I'd love if someone could explain why the whole CORS rigmarole was considered ncessary.