Ideally, a developer should never have to disable Chrome’s web security. Tools like cors-anywhere (for quick proxying) or configuring your local server (Nginx/Apache) to reverse-proxy API requests are superior solutions. They solve the access problem without compromising the integrity of the browser.

When you hit enter, a new Chrome window appears—not your polished everyday Chrome, but a scarred, temporary doppelgänger. A yellow banner warns you: "You are using an unsupported command-line flag: --disable-web-security."

On macOS, you open Terminal and whisper:

open -n -a /Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --args --user-data-dir="/tmp/chrome_dev_test" --disable-web-security

A new instance of Chrome will open with CORS disabled. You can verify this by navigating to a webpage that makes cross-origin requests and checking the developer console for errors that would typically be blocked by CORS.