Comment by rfraile

Instead of sending a request before every defined case in the CORS policy, it could be implemented requesting only one GET to a plain file (fully cacheable) with the domain policy definition.

Like robots.txt for the search engines.