Version 5.0.0 release

applications/core/modules/admin/system/login.php

@@ -329,6 +329,9 @@ class login extends Controller
 		/* Don't cache the CSRF key */
 		Output::setCacheTime( false );
 
+		/* Nor CORS request (e.g. the whole point of CSRF) */
+		Output::i()->httpHeaders['Access-Control-Allow-Origin'] = Url::internal('')->data[ Url::COMPONENT_SCHEME ] . '://' . Url::internal('')->data[ Url::COMPONENT_HOST ];
+
 		Output::i()->json( [ 'key' => Session::i()->csrfKey ] );
 	}
 }