"Since the only way (I believe) to get a POST to fire cross-domain, without explicit user interaction through, say, a regular HTML form, is through JavaScript, the browser would refuse to make the request unless the CORS headers explicitly allowed it."
I'm not quite sure what you're trying to say here. But you can make cross-domain POST requests in two ways, both involving JavaScript:
1. Create an HTML form, use JavaScript to submit it.
2. Use XMLHttpRequest to make a cross-domain POST.
I'm not quite sure what you're trying to say here. But you can make cross-domain POST requests in two ways, both involving JavaScript:
1. Create an HTML form, use JavaScript to submit it.
2. Use XMLHttpRequest to make a cross-domain POST.