I'm specifying an API for a REST service. The REST service will be primarily accessed by web browsers using XHR requests running code hosted from remote origins. Therefore, I'll need to add CORS support, such as the
Access-Control-Allow-Origin header to allow for XSS.
Should I add CORS headers to non-200 responses, such as 400, 401 and 5xx?