The CORS header that quietly opened your API to every website

Here is a change that has shipped in more codebases than anyone would like to admit. The team's single-page app, served from app.example.com, needs to call the API on api.example.com. The browser bloc