CORS, What is it good for?
Imagine you have two browser tabs open, one to your bank, and one to evil-site.com
┌─────────┐┌──────────────┐
│ BANK ││ EVIL-SITE │
├─────────┴┴ ┴────────┐
│ │
│ │
│ │
│ │
│ │
└──────────────────────────────────┘
evil-site.com, knowing you’re probably authenticated to your bank, sends a request to it for some data.
Luckily, your browser complies with the Same-origin policy and won’t let the evil-site.com page see the results of this query when the response arrives.