You can use the origin announce headers from Firefox to block cors also, unsure if that works with chrome. But I was referring to legacy code (or those whose S

You can use the origin announce headers from Firefox to block cors also, unsure if that works with chrome. But I was referring to legacy code (or those whose SPA is stored on the same domain as API endpoints).