@TheMoodBoardz the app is only setting CORS for very specific routes. See https://github.com/getfider/fider/blob/253556bfb632ab9a7c5d552f1e63c1fb1d7c41b1/app/cmd/routes.go#L42C14-L42C30 . Indeed, I can confirm in my test install that feed.atom and also the favicon have CORS set to '*' . I think the upstream app has to fix CORS (if it supports it) for the post routes.