the answers to "what makes CORS hard?" here are so interesting, so far I'm getting
1) The browser's same-origin policy is very counterintuitive
2) Browser network tools do (I think) have all the info you need to debug, but navigating the Network tab is not easy if you're not used to it
3) Sometimes you need to coordinate with many people to set the correct headers
4) Setting up CORS headers to allow multiple domains (like a.com, b.com, c.com) is annoying
(1/?)