[AzMoo_]

Not really. In lots of relatively large companies there is a good relationship between infrastructure, development and security teams and they will work to find a solution that works for everybody.

[vorticalbox]

This is how it works at my work.

CORS is allowed while running locally and then set while running in development and finally production.