Q: Your web application's frontend hosted on `app.example.com` makes an API call to `api.example.com`. The browser blocks the request with a "CORS Error". A developer fixes it by setting `Access-Control-Allow-Origin: *` on the API server. Why is this a major security risk if the API uses cookie-based authentication?

CORS (Cross-Origin Resource Sharing) is a browser security mechanism that inherently blocks a malicious website (like evil.com) from pulling sensitive data from an API (like yourbank.com) using the victim's active session. By setting Access-Control-Allow-Origin: * (wildcard), the developer tells the browser that *any* website in the world is allowed to read responses from the API. If the API relies on session cookies, an attacker can host a malicious page, trick the victim into visiting it, and the malicious page can silently query the API using the victim's authenticated browser session. The browser will permit the script to read the sensitive JSON data returned because the wildcard CORS header explicitly authorized it.