It would be interesting to enable cross origin requests in the REST server (add support to CORS)

The benefits will be:

• The Mobile app will be able to use web workers (background threads) for doing tasks like synchronization of forum messages etc... Currently, this is not possible because only the main thread of the app is able to do this type of requests (see https://code.google.com/p/chromium/issues/detail?id=254993 and http://stackoverflow.com/questions/17496239/is-xhr-allowed-within-web-worker-in-phonegap-cordova)
• It will be possible to implement web apps connecting to a Moodle site. This is currently only possible if the web app is in the same domain that the Moodle site or if you use a XHR proxy in PHP or similar
• It will be great for supporting tincan (xAPI) record storing using the current REST server (or a RESTFUL implementation)

Adding CORS support should be safe since the web service end points do not use the Moodle cookie/session, authentication is done using the token and if it detects that the Moodle cookie is used is throws an exception

The change will be minimal:

In the send_headers method: add this line:
https://github.com/moodle/moodle/blob/master/webservice/rest/locallib.php#L173

header('Access-Control-Allow-Origin: *');