This is true. Could we not disregard requests without an origin header? According to [0] we can force CORS behaviour be using a non-simple request in our webap

This is true. Could we not disregard requests without an origin header? According to [0] we can force CORS behaviour be using a non-simple request in our webapp. By setting the mime type to JSON for example. 0: https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS