CORS (Cross-Origin Resource Sharing) is the browser protecting your users, not the server rejecting you. When a page on one domain requests data from another domain, the browser attaches an Origin header that says exactly who is asking. The server answers normally, but unless its response includes permission, the browser throws that response away before your code ever sees it.
That permission is a single header: Access-Control-Allow-Origin. When the server includes it with your origin, the browser hands your code the data. That's why the fix for a CORS error is always on the server, no amount of frontend code can grant permission the server didn't give.