The main reason is that I've had to re-implement it on the server side 2 times now by sheer "luck", as well as I feel like i've just hit more of the edge cases than most just because of the areas I ended up working in (which just happened to be a handful of canvas-based apps where a couple of them needed to call out to unknown 3rd parties and I had to be very careful about using opaque responses as they would ruin the canvas).

Maybe I'm just full of myself though!

Ah. That's interesting.

And in no way I meant to imply that you were full of yourself :)

I was just curious as I've only done some front-end dev and dealing with CORS was a minor part of it and I'm always interested in HNers with niche jobs or uncommon experience.

The kind of work where you need to run javascript loaded from third party sites and make it do stuff to the user (advertisements, chat).

Not OP, but my guess... Most devs aren't frontend devs and I would categorize this as mostly a frontend developer problem.

I think:

* Most devs are at least full stack

* Most apps now-a-days interact directly/indirectly with browser

* Attributing this problem to frontend devs without understanding why CORS and issues in handling that, makes you unaware of security issues with your backend services.

FYI: I am a backend developer.