title: Is CORS a secure way to do cross-domain AJAX requests?
body: <p>After reading about CORS (Cross-Origin Resource Sharing), I don't understand how it improves security. Cross-Domain AJAX communication is allowed if the correct ORIGIN header is sent. As an example, if I send</p>
  
  <p>ORIGIN: <a href="http://example.com" rel="noreferrer">http://example.com</a></p>
  
  <p>The server checks if this domain is in the white list and, if it is, header: </p>
  
  <p>Access-Control-Allow-Origin: [received url here]  </p>
  
  <p>is sent back, together with the response (This is the simple case, there are also prefighted requests, but the question is the same).</p>
  
  <p>Is this really secure? If someone wants to receive the information, faking an ORIGIN headers seems like a really trivial task. Also the standard says that the policy is enforced in the browser, blocking the response if Access-Control-Allow-Origin is not correct. Obviously if anyone is trying to get that info, he will not use a standard browser to block it.</p>