As of sometime in 2020, the old CORS spec (https://www.w3.org/TR/cors/) now redirects to the WhatWG Fetch Spec (https://fetch.spec.whatwg.org/) which I think is unfortunate because the old CORS spec (https://www.w3.org/TR/2014/REC-cors-20140116/) contains more exposition and also defines “simple method” and “simple headers” which everyone still uses but aren’t even mentioned in the Fetch spec.