> I know the official line is that CORS “protects” the relying party (the website that initiates requests) You're getting that wrong. It doesn't protect the we

> I know the official line is that CORS “protects” the relying party (the website that initiates requests) You're getting that wrong. It doesn't protect the website that initiates the requests. It protects the user from the website initiating the requests. SOP is to stop website A from doing shady things to the user using their session from website B. It does protect you in the sense that protecting your users is also protecting you, but it requires voluntary cooperation from the user, so it doesn't do anything to protect you from malicious users. In the "hotlinking" example you're giving, CORS is only protection from the absolute laziest of attackers, since you can get around that with about 5 minutes of setting up nginx to proxy from your domain to the resources you want to re-use. You can also get the same protection without CORS by blocking requests based on the Referer header