Hi @nharrer,
From what I understood when talking with Julio from the Ionic team, is that in order to remove the internal web server iOS needed a custom scheme to access local files (couldn’t use http) and Android didn’t, hence the difference.
All the different origins are documented in the CORS Errors docs page, but as long as you allow this origin and reflect it back you shouldn’t have any problem.
Best,
Rodrigo