Source from this course: https://udacity.com/course/intro-to-ajax--ud110
CORS works around a sometimes overly-strict browser policy(i.e same-origin policy) meant to protect servers from malicious requests. CORS is enabled on the server-side, so you won't generally need to worry about it for your code. You do need to know about it though, since some APIs support it, and some do not.
The same-origin policy was implemented by web browsers to prevent malicious scripts from untrusted domains from running on a website. In other words, it ensures sure that scripts from one website can't insert themselves into another.
For example, the same-origin policy keeps the bad guys’ JavaScript from somehow running on your bank’s website and stealing your information.
Over time, developers realized that this policy was too strict, and often got in the way of legitimate use-cases. There are many reasons to serve content from multiple domain origins, and so developers found a way