I could be off on this one, so please forgive me if so...
Web browsers have the ability to allow remote web servers access to local network resources... ie localhost on the browsing computer, and potentially other network devices behind the browser. It's enabled by default and there's no UI interface to disable it.
This was news to me and is a bit terrifying. Why in the world would anyone ever allow a remote site to bounce commands through their browser to other devices internally... presumably protected by a network firewall to prevent exactly that?!?!?!
Can someone explain this to me? When I google "disable CORS", it appears as though that would make it more open and less secure. I want to disable the capability outright.
I found one mention of a possible answer at: https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS/Errors/CORSDisabled that references "content.cors.disable", but I can't find a mention of that setting anywhere else, and the link doesn't expand on exactly what it does. The name sounds like what I want, but I don't want to make that assumption and end up making things worse.
If anyone can shed light on this, it would be appreciated. If this is the wrong forum, please let me know which SE site I should post it to.