Yes: "the only way [...] to get a POST to fire cross-domain [...] is through JavaScript". The request would go against the same-origin policy, at which point C

Yes: "the only way [...] to get a POST to fire cross-domain [...] is through JavaScript". The request would go against the same-origin policy, at which point CORS comes into play. Edit: Ah, but creating a form in the DOM and submitting it via JavaScript... that one I hadn't thought of.