It is common for Access-Control response headers to only be set if Origin is set in request headers. For the CORS mechanism to work, that Origin header has to be passed through.
It would be good to find a server that is configured this way, https://interactive.guim.co.uk/ seems to now set Access-Control headers anyway.
It is common for
Access-Control
response headers to only be set ifOrigin
is set in request headers. For the CORS mechanism to work, thatOrigin
header has to be passed through.It would be good to find a server that is configured this way,
https://interactive.guim.co.uk/
seems to now setAccess-Control
headers anyway.