I have an API and a web application that exist in different domains. I can activate CORS on the API to allow for the web application to interface with the API cross-domain.
However it has been brought to my attention that some business, for corporate IT reasons, will opt to block cross-domain requests from their installed browsers for security reasons. If this is the case it is beyond my control. Can anyone comment on this? Has anyone working in corporate IT, or supporting web applications used by them, encountered such an issue before?