Glossary
Cross-Origin Resource Sharing (CORS)
CORS is a browser-enforced mechanism that controls whether a script running on one website's origin can read a response from a different origin's server. It exists to protect users from a malicious page silently reading data from a service the user is logged into elsewhere — but it is enforced by the browser reading the response, not by the server deciding whether the request itself was permitted.
A permissive CORS configuration doesn't grant an attacker access to anything they couldn't otherwise reach directly — a request without a browser's CORS enforcement in the way (a server-to-server call, for instance) is unaffected by it entirely. Treating CORS configuration as a substitute for actual server-side authorization is a common and consequential mistake, since it protects against only one specific attack surface, not against a request that never goes through a browser at all.