Should CORS deny access from curl requests?

[facultymatt]

I'm attempting to use the CORS module to block curl requests (or other rest client requests, such as chrome's excellent Postman). But it's not working.

Im guessing that CORS is only respected when making a request from a browser, and that a server to server request not protected with cors. If this is correct, how would I block a cross server request?

[troygoode]

The node-cors library currently short-circuits and performs no validation if no Origin HTTP header is passed in; this is why curl requests are going through correctly. The reason this is done is that if you were to restrict requests to say, example.com, a user could still easily spoof this in curl like so:

$ curl -H "Origin: example.com" www.yourapi.com/api/foo

In other words, CORS is not a valid mechanism of protecting against server-to-server requests.