If I could have one wish for HTTP, it would be to get rid of CORS. Not only is it an incomplete solution (only protects reads, not writes), it causes tons of di

If I could have one wish for HTTP, it would be to get rid of CORS. Not only is it an incomplete solution (only protects reads, not writes), it causes tons of difficult to debug errors. A half measure in security is often worse than no measure at all because the latter is more obvious and is a much squeakier wheel to fix. The origin headed should be the only way to fix these issues which would force web frameworks and servers to check this header by default. Way simpler, authentication (authenticating the requestor site, not the end user) is done on the server not the client, errors can actually be handled since don't fail silently, and failures appear in server logs as well as the client.