Let's say you're logged in to facebook. Without CORS any site you visit in your browser could send a javascript request to facebook.com/postmessage, posting mes

Let's say you're logged in to facebook. Without CORS any site you visit in your browser could send a javascript request to facebook.com/postmessage, posting messages as yourself without your knowledge or consent ;) That's a problem, so browser block cross site requests (CORS) by default.