CORS Sep 24, 26 CORS should be off by default. It patches a problem caused by poor web application design in the first place.