[5] AMP は独自の「CORS っぽいもの」を使っています。

[2] CORS in AMP - amp.dev, https://amp.dev/documentation/guides-and-tutorials/learn/amp-caches-and-cors/amp-cors-requests/?format=websites

[4] amphtml/amp-cors-requests.md at master · ampproject/amphtml () https://github.com/ampproject/amphtml/blob/master/spec/amp-cors-requests.md

For same-origin requests where the Origin header is missing, AMP sets the following custom header:

AMP-Same-Origin: true

[1] amphtml/amp-cors-requests.md at master · ampproject/amphtml () https://github.com/ampproject/amphtml/blob/master/spec/amp-cors-requests.md

AMP-Access-Control-Allow-Source-Origin: <source-origin>

This header allows the specified source-origin to read the authorization response. The source-origin is the value specified and verified in the "__amp_source_origin" URL parameter (for example, "https://publisher1.com").

[3] CORS in AMP for Email とは違っています。