Same Origin Policy (SOP) and Cross Origin Resource Sharing (CORS).origin (that is, same protocol use, same domain and same port number). For example if abcd.com tries to communicate with bank.com, the browser will block that request unless on the server-side of bank.com, CORS is enabled for abcd.com.abcd.com was allows to fetch data from bank.com, we could have fetch for e.g. user accounts and we don't want that. This is a communication from browser to server.server to server. Normally, can abcd.com server sends a request to bank.com server? Here, is there anything blocking a request? Of course, to be able to send that request, we need a public endpoint but beside that?