eejjjj82

Imagine that your banking website used a standard JSON+REST API with cookie based authentication to trigger & validate a transaction request.

When a request to `fetch` or XMLHTTPRequest is made from ANY site, the browser will still populate cookies for 3rd party sites.

So without CORS, then someone might be able to create a landing page, which in the background triggers a `fetch` or `ajax` request to your bank's transaction endpoint. For 99.999% of people this wouldn't be effective because they are probably not a customer of this bank and are not logged in at the time of the request. But for some very tiny fraction of users, the browser would be tricked into populating the Cookie header from a previously created session in a different tab and would send this request.

The Origin header in the CORS preflight is a signal from the server to the browser that 'yes, this request is safe for you to construct'. This way the browser doesn't let the malicious web page "trick it" in the first place to send the bad request.

  ...
  Also, why is this in big-endian order?
  
  Let's just try to kill big-endian data, it's disgusting 
  and should just die already.

  BE is practically dead anyway, we shouldn't add new cases. Networking
  has legacy reasons from the bad old days when byte order wars were
  still a thing, but those days are gone.