The W3C CORS recommendation states:
Certain types of resources should not attempt to specify particular authorized origins, but instead either deny or allow all origins.
3. A GET response whose entity body happens to parse as ECMAScript can return an Access-Control-Allow-Origin header whose value is "*" provided there are no sensitive comments as it can be accessed cross-origin using an HTML script element. If needed, such resources can implement access control and CSRF protections as described above.
Does JSON parse as ECMAScript?
Can JSON produce side effects when executed via an HTML script element?
Can cross-origin web content gain read access to JSON GET responses from CSRF requests forged via an HTML script element?
What does "sensitive comments" mean in this context?
Does this paragraph apply to GET requests that do not accept cookies or HTTP Authentication for authorization? If a request were otherwise authorized only by OAuth for example, its response would not be accessible to a browser via an HTML script element. But by making its response include
Access-Control-Allow-Origin: * for all authorized requests, the server would lose the ability to specify the origins to which the browser would grant access.
Access-Control-Allow-Origin: * weaken the security of responses to requests authorized by cookies or HTTP Authentication? If a request were authorized by cookie, for example, it would be executable by the browser, but the source code in the response body would not be accessible to cross-origin web content. By making its response include
Access-Control-Allow-Origin: *, the server would communicate to the browser that web content from all origins should have access to read the response in addition to executing it.