> God forbid you have to deal with CORS + mTLS

As someone who is about to deal with exactly this, what kind of trouble am I in for?

Preflight requests won't be doing mTLS on all browsers.