I'm not really deep into such CORS stuff, but I was wondering if we shouldn't send a proper answer to a CORS request.
According to https://developer.mozilla.org/en-US/docs/Glossary/Preflight_request it seems the correct answer would a 204 with some additional headers containing the allowed methods.
@peterhashair did you test what happens if we send a normal answer to the preflight request? Is the tracking request still sent in that case?

@sgiehl right that makes sense, will update that.

@sgiehl I am trying to figure out how to do a response as 204, but I notice there is a set of requests, not just one, if I respond 204 in the foreach, will that affect another request?

@peterhashair You may need to handle that at an earlier stage. As it's not relevant if the preflight request might contain one or more tracking requests, you should do that before the request is actually parsed. Guess here it might suite:

@sgiehl it seems like the prefight works, just wondering should I use the site url store in the data for the Access-Control-Allow-Origin, otherwise there will be security issue I guess.

             header('Access-Control-Allow-Methods: GET, POST');
               header('Access-Control-Allow-Headers: *');
               header('Access-Control-Allow-Origin: *');
               Common::sendResponseCode(204);

I've now applied a couple of fixes and added a simple test to get this ready to merge...