Deep dive in CORS: History, how it works, and best practices
I think the issue most developers have with CORS is how late in the dev cycle you encounter it. When everything in localhost/http you don't see any issues. It only crops up once you deploy to staging/production environments that are actually on the web. Worst case is when it works fine in staging, and only has issues in production and someone else controls the allow list.It usually bites you once, and then you look out for it. But about every web developer I know hits it at some point. There used to be footguns of being able to disable CORS, and devs would provide this as a work around. Thankfully browsers have pretty much disabled these settings without intensive investment.