javascript - Why is CORS without credentials forbidden? -

I am trying to understand why cross domain requests are not allowed without credentials (by default, Em > Access-control-permission-origin header). All are very straightforward in case of a request with credentials - you can complete some malicious actions on any other site, for example on Facebook, if you have logged in on it

for example This request for:

  xhr = new XMLHttpRequest (); Xhr.open ('GET', 'http://www.google.com'); Xhr.send ();   
 Generates an error (I used to execute it from this site in Chrome's console):  
 
 XMLHttpRequest can not be loaded. No 'access-control-permission-generation' header is available on the requested resource, hence "origin" is not allowed.   
 Therefore, the server may need to send an appropriate header (such as  access-control-permission-origin: * ) for this request.  
 This is just a simple request and no cookie is sent. What does this restriction mean? If such a CORS is allowed, then can there be security problems?  
  Without credentials  - I mean the default settings for XMLHTTPRequest without sending cookies are credentials = false, meaning that no cookie is sent in the request -.   
 
 
 I will go ahead and steal with security. SE  
 The main concern here is access control based on the network topology Suppose that you run an HTTP service on your home network (in fact, you do almost certainly, if your router has a web interface ). We call this service as  R , and you can get a service from the only machine connected to your home router.  
 When your browser  evil.example.com , that site provides a script to your browser, asking to bring it the contents of  R  And sends it back to  evil.example.com . It is potentially bad, even without credentials, because it is a breach of the notion that no one outside your local network can see the services running inside your local network. The same-basic policy prevents this from occurring if the same-basic policy came into play only when it was involved in credentials, then it would open the possibility of circumventing topology-based security.  
 Also consider some public services allowing access to the IP address:  
 
 The Oxford English Dictionary comes from universities that subscribe to their online entries. Has restricted access to IP addresses  
 The United Kingdom prohibits access to BBC content from within the IP address  >  
 here In all the cases listed, any The Raujhr can be used as an unwitting proxy for a site that offers this script.