The agent can be faked. There are CORS rules, but those are enforced by the browser, a backend cannot prevent you from calling it, except by requiring an acces

The agent can be faked. There are CORS rules, but those are enforced by the browser, a backend cannot prevent you from calling it, except by requiring an access token or something similar.