CORS prevent js window.onerror from subdomain reporting informations
From the same documentation:
If the server sends a response with an
Access-Control-Allow-Originvalue that is an explicit origin (rather than the "*" wildcard), then the response should also include a Vary response header with the value Origin — to indicate to browsers that server responses can differ based on the value of the Origin request header.Access-Control-Allow-Origin: https://developer.mozilla.org Vary: Origin