Comment by trick-or-treat

I think you're confused. The only thing blocked would be client side fetch. You need to find another way to protect everything else.