CORS doesn't help with compromised client code, since the CORS headers would allow access anyway. CSP [1] can help by preventing malicious code to leak data to

CORS doesn't help with compromised client code, since the CORS headers would allow access anyway. CSP [1] can help by preventing malicious code to leak data to third parties, but it's far from trivial to close all loopholes. Especially with the myriad of tracking and other third party scripts most sites/apps use. [1] https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Co...