If your server can handle Origin checks that way, then leave your CORS headers wide open and problem solved. The problem is that existing servers don’t general

If your server can handle Origin checks that way, then leave your CORS headers wide open and problem solved. The problem is that existing servers don’t generally check origin headers, so browsers needed some other mechansim to understand which requests were safe.