i3.github.io | The i3wm.org website | Web Site library

TLDR: I read that the "origin" header can be set manually for requests, and that CORS policy are only securing browser requests. how can I make my app securely send data to allowed origins ?

I am making a personal server with express that fetches and deliver data from multiple sources to multiple targets, including a static website

On this api I use a few express routes & socket.io, but to keep it simple i am only going to talk about express routes.

I already implemented CORS policy by adding an Access-Control-Allow-Origin header in the response, but I could read that CORS are not enabled for program or server requests (like curl)

So I added a little logic to check if the "origin" header was in my whitelist, like this :