Comment by PantaloonFlames

> It's a nice way to make an API "public", or would be if CORS supported a goddam wildcard for the host.

I don't get what you mean. Access-Control-Allow-Origin supports a wildcard. https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Ac...