Comment by ship_it

From an Infosec perspective, this is normal. CORS should be put on place per local network visibility or host to disallow such feature.