CORS is not meant to secure an API endpoint
> CORS is an implementation in the browser and is designed to protect the user from malicious applications by ensuring that the resource in the browser is only allowed to access specific endpoints.<p>> This browser implementation can be bypassed at any time. First, it is up to the browser itself: if CORS is not integrated, or not integrated cleanly, then it will not work.<p>> An attacker can access the API key via the source code of the web app and use it, for example, via a cURL request to directly access the API resources of the backend. With cURL, no CORS takes effect, so the attacker has direct access with the full rights of the user.<p>All of this is completely wrong.<p>CORS does not protect anything from anyone. The <i>same-origin policy</i> stops code from one site reading resources from another site. CORS selectively <i>removes</i> that protection – it <i>decreases</i> security.<p>If CORS is not integrated, the same-origin policy is in full effect and code from one site cannot read resources from your site. It starts off as secure, and stays secure.<p>If you use cURL, then the <i>same-origin policy</i> doesn’t apply, and you can of course read any resource.<p>The same-origin policy is not a generic access barrier, and shouldn’t be used as such. It stops one site from abusing the user’s authenticated state with other sites, and that’s it.