Rarely does a application actually need to enable CORS. If all of your webcalls are from the same domain YOU DONT NEED CORS. (Chatbots/socket.io) You only need

Rarely does a application actually need to enable CORS. If all of your webcalls are from the same domain YOU DONT NEED CORS. (Chatbots/socket.io) You only need CORS if you need the browser to act as a middleman to pass information back. IE: Credit Card Payment IFRAME If you screw up CORS implementation it just means that anyone can read any information set by your website. https://www.moesif.com/blog/technical/cors/Authoritative-Guide-to-CORS-Cross-Origin-Resource-Sharing-for-REST-APIs/# https://www.moesif.com/blog/technical/cors/Authoritative-Gui...