CORS is not authorization

CORS tells browsers which origins may read a response. It does not decide whether a caller may perform an action on a resource.

A correctly configured Access-Control-Allow-Origin still leaves your API open to any non-browser client that can send the request. Curl, mobile apps, and server-to-server callers ignore CORS entirely.

Authorize on the server for every request: subject, action, and the specific resource. Treat CORS as a browser isolation control — not your permission model.