While this is true, it is complicated by TLS terminating cloud services and the complexity nightmare that is TLS. For example, sub-domain takeover. Basically, T

While this is true, it is complicated by TLS terminating cloud services and the complexity nightmare that is TLS. For example, sub-domain takeover. Basically, TLS rules don't behave exactly as CORS: https://labs.detectify.com/2016/10/05/the-story-of-ev-ssl-aws-and-trailing-dot-domains/ https://labs.detectify.com/2016/10/05/the-story-of-ev-ssl-aw... You could also use the dangling domain to get a Let's Encrypt certificate. It is quite common for sites to allow cross-origin loading from their own subdomains, with CORS and CSP headers.