[floil]

Setting it to star allows arbitrary cross origin access (star means 'any site' in this context). Omitting it is supposed to be the opposite. Important not to confuse the two!

Enabling site per process in chrome will give your users some protection of their data on your site, but only if your mime types are already correct. See the probably linked document for recommended headers.