In the latest EO, the use of "EnableWebSecurity" is obsolete. I assume this mapped to something akin to the Chromium switch "--disable-web-security".

For our app, we require access using the "file://" protocol.

Without EnableWebSecurity set to false, we get CORS errors when making XHR requests.

Is there an equivalent to the Chromium switch "--allow-file-access-from-files" to allow us to get around this? Or a way to mark XHR requests to the "file://" protocol such that the CORS protection doesn't kick in?

(interesting JS/CSS/favicons from our main HTML file are loaded just fine, as is media (like MP3s) using an Audio object from JS, it seems just XHR requests (and I don't think we can use Fetch for file:// access))