Attempting to enable allowing CORS requests on AMP pages as well, to close Issue splashlab#10. You can enable the AMP-Access-Control-Allow-Source-Origin header in the config now.

Author: thaddeusmt

Plugin/CorsHeadersPlugin.php

@@ -61,6 +61,16 @@ protected function getAllowCredentials()
             \Magento\Store\Model\ScopeInterface::SCOPE_STORE);
     }
 
+    /**
+     * Get the origin domain the requests are going to come from
+     * @return string
+     */
+    protected function getEnableAmp()
+    {
+        return (bool) $this->scopeConfig->getValue('web/corsRequests/enable_amp',
+            \Magento\Store\Model\ScopeInterface::SCOPE_STORE);
+    }
+
     /**
      * Triggers before original dispatch
      * This method triggers before original \Magento\Webapi\Controller\Rest::dispatch and set version
@@ -79,6 +89,9 @@ public function beforeDispatch(
             if ($this->getAllowCredentials()) {
                 $this->response->setHeader('Access-Control-Allow-Credentials', 'true', true);
             }
+            if ($this->getEnableAmp()) {
+                $this->response->setHeader('AMP-Access-Control-Allow-Source-Origin', rtrim($originUrl,"/"), true);
+            }
         }
     }
 

etc/adminhtml/system.xml

@@ -19,6 +19,12 @@
                     <source_model>Magento\Config\Model\Config\Source\Yesno</source_model>
                     <comment>Enables Access-Control-Allow-Credentials response header to pass cookies</comment>
                 </field>
+                <field id="enable_amp" translate="label" type="text" sortOrder="40" showInDefault="1" showInWebsite="1"
+                       showInStore="1">
+                    <label>CORS Requests for AMP</label>
+                    <source_model>Magento\Config\Model\Config\Source\Yesno</source_model>
+                    <comment>Enables AMP-Access-Control-Allow-Source-Origin response header for AMP CORS requests</comment>
+                </field>
             </group>
         </section>
     </system>

etc/config.xml

@@ -6,6 +6,7 @@
             <corsRequests>
                 <origin_url>*</origin_url>
                 <allow_credentials>0</allow_credentials>
+                <enable_amp>0</enable_amp>
             </corsRequests>
         </web>
     </default>