Access Data Sources Across Domains setting is confusing

I have created a local desktop app that makes CORS request with my web site and saves data passed from my site.

Since the app is making Cross domains calls (desktop <> Website), my understanding was that I need to Enable Access Data Sources Across Domains
IE > internet options > Security Tab >internet > Custom level > Misc >  Access Data Sources Across Domains

Although when I set the setting to Enable, the calls it will fail.

I need to either set it to Disable or Prompt

Is this a known bug or it this by design?
Has any one else seen anything similar?