> The server has to transmit validation rules for the browser to enforce (with vendor specific caching differences), rather than just enforcing access itself.

> The server has to transmit validation rules for the browser to enforce (with vendor specific caching differences), rather than just enforcing access itself. That's not true. You can set CORS: * and validate all requests in your server. The extra rules are for vast majority of servers that never inspect Origin headers.