It is a solution for AJAX requests to the same problem that CSRF tokens solve for html forms. Imagine a user is logged into facebook, and visits legitimate web

It is a solution for AJAX requests to the same problem that CSRF tokens solve for html forms. Imagine a user is logged into facebook, and visits legitimate website X, which has been hacked to inject malicious script Y. Malicious script Y makes a bunch of API calls to Facebook; since the user has been logged in, the Facebook cookies are sent along with the request by the browser. Malicious site Y could delete your posts, make you join pro-Nazi pages, or exfiltrate your network. With CORS in place, the requests would be denied, because API requests can be set up to reject any requests that are not from a specific list of domains. This is a bad example, because Facebook doesnt rely just on cookies, and in fact does have an SDK for making API requests from third party sites. The principle remains, however, if that were not the case, then CORS would be one possible remedy to the problem.