Denying cross origin resource sharing (CORS) over IPFS doesn't make much sense. All requests should be allowed.
Adding "Access-Control-Allow-Origin: *" to the HTTP headers will enable that.

Use cases:

• I have an app that has a script that wants to access something over IPFS. The script however isn't served over IPFS.
• I'm using a fancy chrome extension, and my gateway went down in the middle of requests. It fell back to gateway.ipfs.io but the rest of the requests are now failing because of CORS.