The advice isn't wrong, but you did misunderstand it. The CORS header will definitively block the request to an AJAX REST API from going through, because it will be a POST request with an `application/json` Content-Type, which will trigger a preflight request.
You're assuming the API will remain identical, just with new headers. I didn't advise this, what they have now is not a semantically RESTful API.
What they have now is a mess made to fit within their image-hack's constraints, there's no sensible reason to keep the same GET pattern without that.
You're assuming the API will remain identical, just with new headers. I didn't advise this, what they have now is not a semantically RESTful API.
What they have now is a mess made to fit within their image-hack's constraints, there's no sensible reason to keep the same GET pattern without that.