title: blocking CORs from origin
body: <p>Trying to understand CORs</p>
  
  <p>If my site, <a href="http://example.com" rel="nofollow">http://example.com</a> is trying to make a request to api.yelp.com, I get that Yelp would need to authorize the cross-origin call with Access-Control-Allow-Origin. However, my colleague is saying that <a href="http://example.com" rel="nofollow">http://example.com</a> also needs a special config to allow the call api.yelp.com. If I read about CORs, I see nothing about the origin site, in this case <a href="http://example.com" rel="nofollow">http://example.com</a> blocking a CORs call. The browser does by default, but it can be allowed to make the CORs call without special permission from the origin. Is this correct, or am i missing something?</p>