tl;dr never use Access Control Allow Origin: * and never simply repeat the requesting origin back in the access control both rules seems kind of obv

tl;dr never use Access Control Allow Origin: * and never simply repeat the requesting origin back in the access control both rules seems kind of obvious to me but apparently not to everyone