Recently, I was struggling with a silly CORS problem.
I was using Postman to test my remote API and everything was working flawlessly.

Then I deployed my frontend application on another remote server and immediatly, I had CORS issues.
I figured out that it was because I did not allow the Origin of the frontend server in the configuration of my backend server.

But then I had to pause a second.

What’s the purpose of CORS if a non-browser client such as Postman is able to bypass it completely by providing a custom Origin in it’s Headers ?

See the following example:

api.server.com is allowing communication with frontend.server.com

Some browser is getting connected to frontend.server.com and then use the application that make frequent request to api.server.com.

api.server.com allow the requests because the browser had set it’s Origin value to frontend.server.com.

Now, a bad actor is attempting to communicate with api.server.com from an external server let’s call it bad.server.com.

Obviously, he can’t do it from it’s browser. Because all the request he sends from his browser have an Origin=bad.server.com and that Origin is not allowed on api.server.com.

So he thinks. And realize that he can use a tool such as Postman. He set Postman’s Header to include Origin=frontend.server.com and is able to query the api.server.com server easily.

My question is following : Why is CORS needed at this point ? If any non-browser client is able to query it using a know Origin header ? Am I missing something ?