[Raqbit]

This is also the reason you can still POST text/plain to random TCP servers on the user's local network, without pre-flight check.

[dividuum]

That’ll be gone soon: https://web.dev/cors-rfc1918-feedback/