How to whitelist domain using Flask CORS
The CORS headers tell the browser which domains it is permitted to access. This is not intended to restrict the access to the server completely, but tells the browser which domains it is allowed to access the server from. It is still up to the browser to obey that. If you do this from CURL it will always work because curl does not enforce CORS like a browser would.