<story><title>How to win at CORS</title><url>https://jakearchibald.com/2021/cors/</url></story><parent_chain></parent_chain><comment><author>lwouis</author><text>When developing a webapp these days, I use a local proxy.&lt;p&gt;This allows me to type a staging&amp;#x2F;production URL into Chrome, and get the frontend and the backend from either my local machine or staging&amp;#x2F;prod. I can mix and match any combination by checking&amp;#x2F;unchecking a box in Proxyman.&lt;p&gt;This means there is no need to whitelist localhost for CORS, and other hoops. Another advantage is that you&amp;#x27;re experiencing the app with SSL, so you may notice bugs that you would miss if you&amp;#x27;re used to work with HTTP locally. I&amp;#x27;ve had these bugs which &amp;quot;only happen on production&amp;quot; in the past, and it&amp;#x27;s a nasty thing to deal with because it will be in a rush, since it happens as a surprise, and impacts users immediately. It can also bypass QA if the QA environment is also using workarounds and not a prod-like setup with SSL and the likes.&lt;p&gt;I recommend giving it a try. It&amp;#x27;s a workflow I haven&amp;#x27;t seen promoted anywhere before.</text></comment>
<story><title>How to win at CORS</title><url>https://jakearchibald.com/2021/cors/</url></story><parent_chain></parent_chain><comment><author>88913527</author><text>I can tell you how to lose at CORS in Chrome. If your browser caches a response, and sometime later you mutate the request by adding the &amp;quot;Origin&amp;quot; header it (e.g, add attribute crossorigin=&amp;quot;anonymous&amp;quot; to a &amp;lt;script&amp;gt; tag), Chrome won&amp;#x27;t make a new request. What it will do is use the cached response, which is missing the ACAO response header, and thus the browser rejects a file from its own cache via draconian security policy.&lt;p&gt;There are many ways to lose at CORS and this one is my story.</text></comment>