SANKALP HARITASH Yes, and just by the existence of this possibility (tools that don't give a darn about CORS) is what makes CORS a pretty much useless feature. In the end CORS exists to annoy legitimate users of your API. That's it. Security where? Nowhere. Even web browsers have a way to turn off CORS. You don't even need Postman or anything else. Just run Chrome with security turned off.
So my point being: CORS doesn't work because it cannot deliver, and I believe your article is just following the trend of praising CORS when in fact there is nothing to praise. I get it, it is what all authors do. Still: It would be refreshing to read the real truth about CORS instead of the usual lies.
José Pablo Ramírez Vargas
CORS is in no way a critical component of web security. If anything, CORS is a major pain for web developers. CORS does not prevent unauthorized access, does not prevent data breaches and instead it bugs the web developers over nothng. Only web browsers respect CORS because CORS' major fault is that is a client-side "security" measure. This means that you can (very easily) use a client that does not follow the rules. The perfect example is Postman. So where is the security? Nowhere to be found.