Follow
CORS headers seem counter productive to me.
The browser doesn't allow cross-origin requests for security.
But there are times when you want to be able to do cross-origin things.
CORS to the rescue. But instead of going with the whole 'security' thing where your browser would determine if cross origin things are allowed, the remote server gets to tell your browser that it is allowed.
'Don't talk to strangers, unless the stranger says it is ok, then they can do whatever they want'
