title: CORS header flow
body: <p>I do not understand something with CORS headers:</p>
  
  <p>Let's suppose i have my website on this domain: <a href="http://myverynicesite.com" rel="nofollow noreferrer">http://myverynicesite.com</a></p>
  
  <p>Let's suppose a hacker managed to inject malicious javascript code on my site.</p>
  
  <p>This malicious javascript is sending data to the hacker's website: <a href="http://hackerwebsite.com" rel="nofollow noreferrer">http://hackerwebsite.com</a></p>
  
  <p>There is something i do not understand with CORS headers: The header which allow is set on webservice site. So, the hacker will just have to add this header and it will work:</p>
  
  <pre><code>&lt;?php
  header("Access-Control-Allow-Origin: http://myverynicesite.com");
  ?&gt;
  </code></pre>
  
  <p>I do not understand why CORS does not work with an inverted flow ? I was thinking that myverynicesite.com should allow hackerwebsite.com with CORS. And i see this is hackerwebsite.com which allows myverynicesite.com.</p>
  
  <p>So i do not understand the value add of CORS.</p>
  
  <p>Thanks</p>