CORS Cross-Origin Resource Sharing
The rules for when a webpage may call another domain's API from the browser.
Default policy: a site on thern.io may not call example.com/api via fetch without permission. The server has to send Access-Control-Allow-Origin: https://thern.io in its response.
Protection against a malicious site reading your logged-in data from another site. A browser-only protection — server-to-server calls aren't affected.