@sod My approach has basically been to enable CORS as-needed for specific endpoints, just to make sure I don’t open up any risks. You need GET to /micropub? Let’s follow up in email.