Blog
Insomnia and other REST clients: Electron shells and why they differ from Chrome CORS
Desktop REST tools may bypass same-origin rules that browsers enforce for web pages.
1 min read
insomniaelectronapi
Security assumptions
Do not treat REST client success as proof that public websites can call your API.
OAuth redirects in Insomnia still need correct redirect URIs separate from CORS.
Documentation
Publish example fetch snippets that run in the browser for integrators who copy-paste.
Keep Insomnia exports for internal QA, not as customer-facing guarantees.