An invaluable resource IMHO: https://w3c.github.io/webappsec-cors-for-developers/