I don't see any problems here. Even though they are on the same LAN, they are still on different host, thus subjecting to CORS restrictions. That is, as long a

I don't see any problems here. Even though they are on the same LAN, they are still on different host, thus subjecting to CORS restrictions. That is, as long as your devices on LAN do not send a access-control-allow-origin header, the web pages are not capable of getting the actual response. Also, the only http method available to them is GET (when preflight is not required) and OPTIONS (when preflight is required), which are methods that are almost always side-effect free and only return some value - which the script cannot even get due to CORS restrictions.