Then it means that a service is vulnerable by default unless it implements the list of allowed origins. With CORS if there are no headers then it means no autho

Then it means that a service is vulnerable by default unless it implements the list of allowed origins. With CORS if there are no headers then it means no authorization.