Interestingly, your hacky workaround to client non-cooperation sounds very much like what others are suggesting as their first-choice solution anyway! See for

Interestingly, your hacky workaround to client non-cooperation sounds very much like what others are suggesting as their first-choice solution anyway! See for instance this comment: https://news.ycombinator.com/item?id=29778528 https://news.ycombinator.com/item?id=29778528 Which suggests implementing the CORS response in a reverse proxy or some other covering layer. And of course the OP also involves a reverse-proxy, although one mapping to avoid the need for CORS headers.