THE PAGE (browser)

Page is served from https://app.example.com https://admin.example.com http://app.example.com https://api.example.com Page asks the API (https://api.example.com) to GET /items POST /items (form data) POST /items (JSON body) DELETE /items/7 GET /me (send my cookies)

THE SERVER (api.example.com)

Access-Control-Allow-Origin (header not sent) * https://app.example.com https://admin.example.com Allow-Methods lists DELETE Allow-Headers lists Content-Type Allow-Credentials: true