interesting article, although unfortunately it mentions but doesn't currently cover one of the more mis-understood parts of CORS, which is the Access-Control-Al

interesting article, although unfortunately it mentions but doesn't currently cover one of the more mis-understood parts of CORS, which is the Access-Control-Allow-Credentials part. The fact that Access-Control-Allow-Origin: * doesn't work with Access-Control-Allow-Credentials, for example, is something I've seen sites get wrong quite a lot. there's a good post which covers it https://mortoray.com/2014/04/09/allowing-unlimited-access-with-cors/ https://mortoray.com/2014/04/09/allowing-unlimited-access-wi...