The question is for the security community to resolve some misunderstandings here.
The crux:
- Company (Wire) has a client (official-client.com) and a server code (e.g. official-server.com ).
- CORS currently allow official-client.com to access official-server.com, but unofficial-client.com does not have access to official-server.com
- The code for official-client is available for reuse for custom applications (supposedly, to host on unofficial-client.com)
The use case here is straightforward: exposing auth protected API services to others. And the definition of "others" is currently set to "official-client.com" only.
Question: What benefit is there in not having?
Access-Control-Allow-Origin: *
To quote another article, it appears the app is not as secure if it relies on its security by restricting resource access to one domain (as the domain can be faked with DNS/local hosts). But that's not really the issue.
What am I missing?