I'm trying to make certain I understand SOP/CORS policy. The particular scenario I'm interested in is:
An HMTL page and JavaScript are served from domain company-one.com. However, the JavaScript code will issue a POST to domain company-two.com.
First assumption: I think the POST will fail due to origin policy. Is this correct?
Second assumption: If I setup an access control header (Acccess-Control-Allow-Origin: company-one.com) on the company-two.com server, the POST will work. Is this correct?
The POST will fail, but keep in mind JavaScript fetch/AJAX is not the only way to make POST requests. Even without an Access-Control-Allow-Origin, company-one.com can still make (and automatically submit) a form that would cause a POST request to company-two.com, possibly with the user's cookie.
Yes. Also consider adding Access-Control-Allow-Methods: POST, OPTIONS