title: HTTP origin header and security concern with same origin policy
body: <p>I'm digging a bit into cross-origin requests and I'm not sure to understand how same origin policy can be efficient. There is lots of topics about how to deal with CORS but few explaining why is same policy needed.</p>
  
  <p>This <a href="https://stackoverflow.com/questions/14898876/the-concept-of-cors-and-should-i-enforce-an-origin-header">topic</a> gives some good answers but I still have questions.</p>
  
  <ol>
  <li><p>Is it the server that should check the Origin header and if not corresponding to any item in its authorized origins list, block the request, or at least not process it ? Or should the server not care about it and let the browser block it ?</p></li>
  <li><p>In this last case, that means the request will be processed by the server, and may change the database state or perform some actions that should be blocked, am I right ?</p></li>
  <li><p>I've heard about 'preflight', and in case the OPTIONS request returns that the current domain is not allowed by the server, is it the browser that will block the second request ?</p></li>
  <li><p>Is the Origin header really secure ? I mean, is it not possible to change it via the javascript code ?</p></li>
  </ol>
  
  <p>I would appreciate any help :)</p>