What do you mean by there by default? There are a lot of ways you could send a valid response without including that header or tag, any policies are not one-si

What do you mean by there by default? There are a lot of ways you could send a valid response without including that header or tag, any policies are not one-size-fits all and could be different. Maybe you’re using a full-stack framework which is managing it for you? Or maybe you’re confusing it with CORS?