With CORS we can choose from: 1. Apply more specific security appropriate for your use case 2. Put it on the same host 3. Origin *. Teams that do this probab

With CORS we can choose from: 1. Apply more specific security appropriate for your use case 2. Put it on the same host 3. Origin *. Teams that do this probably have bigger security problems anyway. Without CORS, we'd all be stuck choosing between 2 and 3.