CORS

Cross-Origin Resource Sharing is enforced by the browser on behalf of the server. The server states which origins it accepts in an Access-Control-Allow-Origin header, and the browser refuses to expose the response to any other origin.

The Origin header itself is set by the browser and cannot be overridden by page JavaScript, which makes it a genuine signal about where a request came from — for requests that actually come from browsers.

It is not a defence against a determined attacker with a scripted HTTP client, which is why an API that writes data should treat an origin allowlist as one layer among several, never as the authorization itself.

Why it matters

For an embedded widget, the origin allowlist is what prevents a public key lifted from your page source from being usable somewhere else in a browser.