When I first learned about CORS, I had trouble understanding it because I couldn't figure out how this protected the server and I couldn't understand why you would do this just for the client 😄

One thing to note, CORS only makes sense if your API uses cookies for authentication, most APIs use custom headers, the Authentication header, or even url tokens, they don't rely on cookies, so most of the time, APIs don't care about CORS. People keep blindly repeating that accepting all origins "*", is bad for security, but the situations where this is relevant are really uncommon.

Absolutely NOTHING! Good God, y'all.

protecting me from using my fucking browser, most of the time