> It's not protecting C from anything I can see, because any restrictions C specifies in the CORS response headers depend on U honoring them to do anything. Som

> It's not protecting C from anything I can see, because any restrictions C specifies in the CORS response headers depend on U honoring them to do anything. Someone trying to do something malicious with C could just ignore them U will honor the CORS headers, unless they disable Web security in their browser. If U visits a Website with some malicious JS that tries to access C, that request will be blocked. One doesn't simply pass CORS on the client side,the relevant headers are forbidden and can't be rewritten or worked around unless you use some Proxy Server.