I've tried to deal with CORS, but I find it very confusing which different setting covers which scenario and which side needs to send what. Maybe I'm missing s

I've tried to deal with CORS, but I find it very confusing which different setting covers which scenario and which side needs to send what. Maybe I'm missing something obvious, but I was trying to get a pdf file embedded in an iframe, where the pdf and the web page are on the same server. So what needs to be sent with the webpage that has the iframe tag's response? What needs to be sent with the pdf file's response? Also, I have some links that pull in styles from an external CDN (probably something I need to eliminate at some point, but these styles pull in font resources using relative urls and I need to untangle all of that to set it up locally, and it's probably not worth it at the development stage). These broke while I was experimenting with CORS. I also have images and scripts and styles that are local. Browser-variations on the CORS headers and conflicts between different headers was something else I found confusing. I just ended up disabling CORS, probably will look into it again when I'm preparing to move into production, but it really struck me as a frustrating time sink.