Re: CORS

On Thu, Oct 12, 2017 at 12:00 AM, Jack (Zhan, Hua Ping) <jackiszhp@gmail.com
> wrote:
>
> But in one sentence: I do not need the browser to do the authorization
> check for me, I do the authorization check myself at server
> https://bankA.com/.
>

Effectively you want to get rid of the same-origin policy. This isn't going
to happen because everybody else relies on it working. CORS exists because
the same-origin policy exists. And the same-origin policy exists to avoid
exposing side effects and data to third parties for data requests which
where introduced to the web at a later stage when there was already a large
volume of existing sites which couldn't all be changed.

In essence it seems you're not happy with how history went, and you'd like
the entire world to change all at once so that you can avoid adding a
perfectly functional http header...