> Really CORS cannot be used to lock anything down. yep, that's what Cross-Origin Resource Policy (CORP) for. It is designed to seal the last loop hole in sa

> Really CORS cannot be used to lock anything down. yep, that's what Cross-Origin Resource Policy (CORP) for. It is designed to seal the last loop hole in same-origin policy. (img and scripts don't require cors at all) But there is a big gotcha, the old browser that don't know about it simply don't care. So it isn't strictly useful for now.