Exactly: Most modern browsers respect CORS. If you send response header "Access-Control-Allow-Origin: *", you're saying any origin can load the response. Clearl

Exactly: Most modern browsers respect CORS. If you send response header "Access-Control-Allow-Origin: *", you're saying any origin can load the response. Clearly, the owner of cdn.fakercloud.com didn't want that behavior. The server can inspect the Origin header, and if the maintainer doesn't want to support the domain, then don't send the CORS Access-Control-Allow-Origin response header.