Scenario:
- I am managing a production web server, such as https://example.com, which is configured with CORS restrictions that do not allow localhost origins.
- Developers working on localhost are creating a new page/module that requires making AJAX calls to the production server during development. They are using Chrome with command line arguments --disable-web-security --user-data-dir=chromeNoCors to allow AJAX calls without the Origin header.
- The issue arises when only GET requests are sent without the header. POST requests still include the header, causing the production server to compare the header value (http://localhost:5678) with the allowed set of origins and denying access to the requested resource.
Query: Is there a way to completely prevent the sending of the Origin HTTP header?
I understand that a workaround would be to add "localhost" (or a specific host) to the list of allowed origins on the production server, but I would prefer to avoid this if possible.