A teammate says: "Our API only allows our frontend's origin in CORS, so other people can't call it." Why is that wrong?

It's wrong because browsers enforce CORS, not the server. The server only sends headers. The browser then decides if a page's JavaScript may read the response.

Anything outside a browser ignores these headers. For example:

• curl
• Postman
• a Python script
• another backend

These can call the API with any Origin header, or with none, and read the response.

Even inside a browser, CORS mostly controls reading responses. Simple requests, like a form POST, are still sent to the server. The browser only hides the response from the page.

So CORS is not access control. It is a safe way to loosen the same-origin policy for browser clients. The same-origin policy means a page may only read responses from its own origin.

To protect the API, you need:

• authentication
• authorization checks on every endpoint
• rate limiting
• input validation

You can use the Origin header as one signal, but never as the only one.