something I don't think I've ever seen explained is whether there's any situation where it's safe to set "Access-Control-Allow-Origin: *" other than "if your site literally never serves any private data"

(I often hear "don't do it" which is fair I guess, but also like the Mastodon API intentionally sets Access-Control-Allow-Origin: * and that's extremely useful)

0

If you have a fediverse account, you can quote this note from your own instance. Search https://social.jvns.ca/users/b0rk/statuses/116014225905367347 on your instance and quote it. (Note that quoting is not supported in Mastodon.)