So the issue with all of this CORS complexity is that legacy (and perhaps today's?) servers don't check for the Origin header, thus being vulnerable to XSRF attacks, i.e. browser vectors only? I guess it's too late now, but I can't help but think that the XSRF-issue should have been fixed by vulnerable server software instead of effectively turned off by browser vendors and re-enabled with major header and preflight bloat. Especially now that cross-origin is so common due to the microservice trend.

I did some work recently on a large "modern" website and man the amount of seemingly unnecessary origin related metadata is insane, mostly due to XHR chatter.