A browser enforces a set of rules for you, and your server's job is to set them.
CORS
Also called cross-origin resource sharing
A browser rule: a script on one site can't read a response from another site, unless that site's server says it may. The server says so in a header, Access-Control-Allow-Origin. It only constrains browsers, so curl ignores it.
A CORS error is loud and blocks the feature, so the fastest way to silence it is to allow everything. That makes the error vanish and may open up logged-in data to any website. Look at what your agent did to make that error go away.
“Allow only https://app.example.com. Don't echo back the Origin header, and don't use a wildcard. Add a test that a request from https://evil.example gets no Access-Control-Allow-Origin header in the response.”