CORS is primarily a concern for frontend engineers, though its implementation depends on backend. In my experience, many backend engineers struggle to understan

CORS is primarily a concern for frontend engineers, though its implementation depends on backend. In my experience, many backend engineers struggle to understand it because it's not their concern. I found comparing CORS with CSP helpful in understanding both concepts: https://stackoverflow.com/a/50726191/1472186 https://stackoverflow.com/a/50726191/1472186 (I wrote the answer) Also, like others have pointed out, CORS or CSP depends on the client (browser) to enforce it. So it doesn't protect against attacker with customized clients.