Enabling API to public CORS requests
As we know, CORS allows restricted access to resources from another domain (for example, fonts, images, and so on). Generally, it is a browser's responsibility to honor the restriction by verifying the headers in the request and the responses from the client and the server.
There are a few resources that we may request from our domain to any external domains. Fonts and images are a few such example resources. To allow such resources to be served, we need to enable the APIs to serve resources to any public CORS requests.
As we discussed earlier, we need to add a wildcard (*) to the Access-Control-Allow-Origin header in the response header from the server. A wildcard same-origin policy is suitable when an API response content is meant to consume publicly and is intended to be accessed by anyone on the Internet. A wildcard (*) does not allow any request to supply credentials or cookies.
