I thought they did for resources and JS, which is why Meta have to use WebRTC instead? I think the Yandex one slips through because CORS does a naive check aga

I thought they did for resources and JS, which is why Meta have to use WebRTC instead? I think the Yandex one slips through because CORS does a naive check against just what's in the header, not what it resolves to?