Comment by wryanzimmerman

What do you mean by there by default?

There are a lot of ways you could send a valid response without including that header or tag, any policies are not one-size-fits all and could be different. Maybe you’re using a full-stack framework which is managing it for you?

Or maybe you’re confusing it with CORS?