CORS lets a server say “these other origins are allowed to read my response.” Without an Access-Control-Allow-Origin header, browsers block the response from JS.
CORS
Cross-Origin Resource Sharing — browser policy that gates cross-domain fetches.