When websites share data
Browsers normally stop code on one website from reading responses from another. This default is called the same-origin policy and helps protect private information.
Through CORS headers, a server can make an exception. For example, a shop’s API at api.shop.example can allow its web app at shop.example to read its responses. For some requests, the browser checks permission first in a preflight request.
Not a sign-in check
CORS is enforced by browsers; it does not stop phone apps or servers from making requests. Websites still need sign-in and permission checks for private data. A setting that is too strict can cause a “blocked by CORS policy” error; one that is too broad can let other websites read data they should not.