[vorticalbox]

This is how it works at my work.

CORS is allowed while running locally and then set while running in development and finally production.