title: Are there any negative consequences to enabling CORS for all resources?
body: <p>CORS is a great thing.</p>
  
  <p>Especially when we have webservices that are called from a cloud-based CRM that doesn't contain our domain name.</p>
  
  <p>BUT, it is it an unalloyed good?
  I am feeling pressure to make all resources from our ReST-ish webservices serve out CORS headers.</p>
  
  <p>I'm nervous that CORS may expose a 'hole' in our design... And my instinct is that information-hiding is what makes programming not devolve into spaghetti code.</p>
  
  <p>Is there any literature about when CORS-ifying your resources goes too far? (I haven't found any, but I may not be looking in the right places)</p>