CORS as show stopper: Why does BigIP not send "Access-Control-Allow-Origin" headers?

Hi all,

I would like to access the iControl API from my local PC (whichis in a other domain as my BigIPs). Testing stuff with Postman is fine, but to get a nice quick view of things, a small HTML-File with Javascript that you can open locally in the browser would be much nicer.

I use Javascript's Fetch-API to do the calls, but the CORS Policy (Cross Origin Resource Sharing) hits me hard. As I can see from the Dev-Tools in Chrome, the BipIP does not send the appropriate response header "Access-Control-Allow-Origin", so no cross origin access is allowed.

I was wondering why this is the case. Should an API not be cross domain accessible? Do I miss anything obvious here? And why is Postman (which is an Electron app, so basically HTML and Javascript) is able to perform requests?

I really don't want to set up any server or install node.js on my PC just to fiddle around with that stuff.

So, is there any way to access the iControl API with local javascript?

Cheers, Ichnafi