My issue depends on a couple of assumptions I hold true.
Assumption nr 1: The Origin Header
The Origin header is required by the browser to be put on a CORS (Cross Origin Resource Sharing) request.
To initiate a cross-origin request, a browser sends the request with an Origin HTTP header.
The first thing to note is that a valid CORS request always contains an Origin header. This Origin header is added by the browser, and can not be controlled by the user.
W3:
If the request URL origin is not same origin with the original URL origin, set source origin to a globally unique identifier [..].
Assumption nr 2: Internet Explorer 10+ support CORS
See caniuse.com and use google for a couple of hundreds more sources of different kinds claiming the support.
Assumption nr 3: Different ports is a different origin
Resources using different port numbers is considered to be of different origins:
Two resources are considered to be of the same origin if and only if all these values are exactly the same. [..] Failure - Same protocol and host but different port.
Two pages have the same origin if the protocol, port (if one is specified), and host are the same for both pages.
The problem:
Internet Explorer 11 does not send the Origin header when making a CORS request to the same domain "localhost" but using different ports (from 8411 to 8080). Opera, FireFox and Chrome do send the Origin header. Yet everybody keeps saying CORS is supported in Internet Explorer 10+?