The problem with cross-origin requests as I understand it essentially boils down to cookies. If cross-origin requests weren't blocked by default, any site you v

The problem with cross-origin requests as I understand it essentially boils down to cookies. If cross-origin requests weren't blocked by default, any site you visit could send requests to your bank, for example. Since those requests would send auth cookies, they could potentially make changes to your bank account. So these requests are disabled by browsers unless the bank explicitly tells them (via CORS headers) that it's ok. IMO the better way to handle it is by allowing cross-origin requests, but locking down cookies so they aren't sent cross-domain by default (ie by setting SameSite on cookies). For my services I generally open CORS up, but only implement authenticated requests with API tokens. The main problem is if you set a custom header (such as Authorization: Bearer) it triggers a preflight request. The only reasonable way I know around this is sending the token in the query parameters, but that also introduces some security issues.