The browser doesn't know by default what websites should be accessed. They don't know that l337haxor.dev doesn't have access to api.bank.com but bank.com does.

The browser doesn't know by default what websites should be accessed. They don't know that l337haxor.dev doesn't have access to api.bank.com but bank.com does. Instead it's the server at api.bank.com 's responsibility to tell the browser it only accepts requests from bank.com.