This is kind of like the reports I see every so often to Django's security address, where someone demonstrates that they can CSRF their own session. The reply

This is kind of like the reports I see every so often to Django's security address, where someone demonstrates that they can CSRF their own session. The reply is always "yes, you can CSRF yourself, because it's not supposed to protect against that; it's supposed to protect you from other people". In exactly the same way, CORS is there to protect you from other people. You can always hack your own user-agent to disregard CORS, but the only person you can harm that way is yourself.