CORS doesn’t protect against CSRF. CORS also permits the initial request, where this change will permit the server to drop the clients request. The problem is

CORS doesn’t protect against CSRF. CORS also permits the initial request, where this change will permit the server to drop the clients request. The problem is the header isn’t really usable until uptake is substantial, dropping requests now creates a workflow deviation based on user agent, meaning while some gain security, the header cannot be relied on entirely.