title: How is CORS protecting the app?
body: <p>I am having problems grasping the CORS concept...</p>
  
  <p>The way I see it the same-origin-policy protects the app from making an ajax call to "untrusted domain". So, <strong>mydomain.com</strong> makes an ajax call to <strong>somedomain.com</strong> and the resource JSON/Script will not be retrieved.</p>
  
  <p>I thought this is to protect the web app when some XSS vulnerability is discovered and someone puts that code using the  tag into your page content and now can make ajax calls to other domains. - Am I right?</p>
  
  <p>If I am right then CORS offers no protection because it's the server policy saying that if a request from <strong>mydomain.com</strong> comes to <strong>somedomain.com</strong> it should be allowed. Now, if I am attacking I would add my script and in my server I would set the CORS policy to allow those requests. From what I get CORS can totally bypass the same-origin-policy</p>
  
  <p>:|</p>
  
  <p><strong>UPDATE:</strong></p>
  
  <p>Reading a bit more I found answers that claim that CORS is not to protect the <strong>mydomain.com</strong> app, but the <strong>somedomain.com</strong>. Let's say somedomain.com is your bank that offers APIs to make bank transfers. Bank would allow API calls coming from the browser that has their app loaded (the same domain). In their CORS policy they can say that the script coming from <strong>mydomain.com</strong> can call their API's. Note that client's browser can have the  cookies for the bank set nad  that opens the bank to the attack by scripts coming from <strong>mydomain.com</strong></p>