[egberts]

I know that CORS is stupid.

It took a CORS expert from W3C to answer this convoluted CORS question.

https://stackoverflow.com/questions/62289103/same-origin-req...

[egberts]

Still a bug in Firefox.

https://bugzilla.mozilla.org/show_bug.cgi?id=1644503

[cxr]

But that's not a CORS problem. It's a CSP problem. (And CSP deserves to be despised.)