Earlier quoted context omitted.
> Unfortunately with today's SPA apps we don't even get the HTML directly It works the other way: with today's SPAs the API (that powers the frontend) is exposed for us to use directly, without going through the HTML - just use your browser's devtools to inspect the network/fetch/XHR requests and build your own client. ----- On an related-but-unrelated note: I don't know why so many website companies aren't allowing…
CORS ruined this pipe dream. Ideally you’d be able to tell your browser that website X loading content from site Y was a-okay and exactly what you want to happen because site Y is user-hostile and site X addresses all those issues, but alas. Now the only way to access site Y is by a) routing all your data through some third party server, or b) installing a native application which has way more access to your machine…
But I do agree that CORS is being hijacked/abused for this purpose. But at the same time it's an important security feature. It prevents the scenario where you visit some website and some malicious javascript starts making calls to some-internal-site/api/... and exfiltrating data.