Comment by xg15

I mean, it still relies on a vulnerable configuration (not checking the content type)

For adhoc dev tools, you could also just disable CORS: https://berkkaraal.com/notes/other/chrome-disable-cors/