Apart from the misunderstanding that CORS protects you, you are describing two scenarios. I don't really understand the first one or why you think SOP should p

Apart from the misunderstanding that CORS protects you, you are describing two scenarios. I don't really understand the first one or why you think SOP should protect you in that case. Could you restate that problem? The second one is a CSRF issue, as noted by another user. The third thing you describe is not people who disable CORS but actually use CORS to the max (usally things like Access-Control-Allow-Origin: *), because they don't understand what it does. It's a huge problem...