Few messages generate as much frustration as a CORS error blocking a request that "should just work". The instinct is to see the browser as being obstinate. In reality, CORS is a deliberate security mechanism, and the error means it is protecting users exactly as designed. Understanding what it guards against turns the error from infuriating to informative.
The starting point is a rule the whole web is built on.
The same-origin foundation
By default, browsers enforce a same-origin policy: a page can freely talk to its own origin but is restricted from freely reading responses from a different origin. This exists to stop a malicious page from quietly making authenticated requests to sites you are logged into and stealing the results. Without it, the web would be far more dangerous.
CORS is the controlled way to relax this restriction for cases where cross-origin access is legitimately wanted.
What CORS actually is
Cross-Origin Resource Sharing is a system where a server can declare, via specific response headers, that it permits requests from certain other origins. The browser checks these headers and allows the cross-origin response through only if the server has explicitly opted in. So a CORS error almost always means the server has not granted permission for that origin — not that the browser is broken.
For some requests, the browser even sends a preliminary "preflight" check to ask the server whether the real request is allowed, before making it.
Fixing it correctly
Because CORS is enforced by the browser but controlled by the server, the fix belongs on the server: configuring it to permit the origins that genuinely need access, and only those. The tempting shortcut of allowing every origin indiscriminately defeats the security purpose and should be avoided, especially for anything sensitive.
Read the error as a message from a working security feature: "this server has not said your origin is allowed". Then grant the permission deliberately, narrowly, on the server — and the mystery evaporates.