I've strangely not had any problems with CORS. Most of my time is spent wondering why CORS doesn't preflight something, when it's obviously a very bad idea to

I've strangely not had any problems with CORS. Most of my time is spent wondering why CORS doesn't preflight something, when it's obviously a very bad idea to call it without a preflight. (The answer is: legacy. NCSA Mosaic did something, so Chrome 89 has to do it too. The result is that we spend 6 million person hours on XSRF tokens and carefully-drawn security vulnerability brand assets.)