> > What stops a script on evil.com from going to bank.com... > CORS CORS does the exact opposite to what you think. Those types of cross-site requests are f

> > What stops a script on evil.com from going to bank.com... > CORS CORS does the exact opposite to what you think. Those types of cross-site requests are forbidden by default by the Same-Origin Policy (SOP) and CORS is designed so you can allow those requests where they would otherwise be forbidden. CORS is not a security barrier. Adding CORS removes a security barrier.