title: Security concerns about CORS
body: <p>I've just learned about CORS, basically because I didn't need it until now.</p>
  
  <p>I've read that CORS enables cross-site origin, by sending HTTP headers with the AJAX call, so the other server can evaluate the request is coming from an approved site.</p>
  
  <p>Now my main concern is, can't the HTTP headers be spoofed? For example, can't an attacker curl a request to the other server, sending the exact HTTP headers that my CORS request does?
  In that case, the server will accept the request, and the attacker will retrieve any sensitive data the server will send him.</p>
  
  <p>We all know how easy it is to retrieve javascript from a page, so everything I send with CORS can easilly be seen by keen eyes. HTTP headers included.</p>
  
  <p>So, I guess sensitive information should never be shared within a CORS communication...
  Or did I get this everything wrong?
  Please shed some light! :)
  Thanks</p>