Discussed at the time:

Developers don't understand CORS - https://news.ycombinator.com/item?id=20404578 - July 2019 (355 comments)