I think you're confused. The only thing blocked would be client side fetch. You need to find another way to protect everything else.

> The only thing blocked would be client side fetch.

Exactly what I need. My API is public I just don’t want someone other than my own website to consume it. Is it that hard to understand?

That’s… not what cors does? CORS will only block browser-mediated “non-simple” requests, they don’t prevent other systems from accessing it as long as they don’t use a browser (or disable CORS in a headless browser).

I'm pretty sure they understand that since they wrote that the resources will need to be proxied.

They just want to prevent hotlinking/leeching.

SOP does not prevent hotlinking in the first place, a hotlink is simple request (the most simple if anything), CORS isn’t going to be in the path at all.

Hotlinking/leeching applies to img or media assets, CORS offers NO protection from that AT ALL.

cors is not about protecting your assets, you dummy. It's about protecting the rest of us FROM your assets.

How's it going with AI scrapers for you

AI cant scrape my API. There’s no index for them to crawl.

Doesn't matter, they just DDoS whatever they find

Brute force on common patterns -> DDOS.