I don't get where the problem is. CORS is well defined here: it ALLOWS a browser to make certain types of requests to endpoints outside the domain the browsed

I don't get where the problem is. CORS is well defined here: it ALLOWS a browser to make certain types of requests to endpoints outside the domain the browsed website comes from: https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS Because the browser follows the same origin policy for a number of API (like FETCH): https://developer.mozilla.org/en-US/docs/Web/Security/Same-origin_policy https://developer.mozilla.org/en-US/docs/Web/Security/Same-o... Also if you are a developer, please check: https://developer.mozilla.org/en-US/docs/Glossary/CSP https://developer.mozilla.org/en-US/docs/Glossary/CSP https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-... To add an extra layer of protection against cross site scripting. I think one of the recent data leak could have been avoided if the website implemented that very basic header all modern browsers support.