llink/js/desktop/README.md

Notes

CORS for desktop app

In dev: each renderer process has its own localhost port. The renderer process passes this in the Origin header for requests, and expects appropriate ACAO headers in the response.

In packaged app: the renderer process does not include Origin header, so expects no extra ACAO headers from the server, otherwise the client would fail to accept responses.