[felipelemos]

CORS is not a tool to turn resources private, but to protect the browser (not the server's content) from cross domain requests.

[scottydelta]

Exactly, the attacker can always not use the browser and emulate a browser request if motivated enough.

[throwawaymath]

Yes, that's precisely why CORS is a poor fit for authentication :)

[askmike]

Sure, but I don't see why the tip in OP is "don't use CORS". To me that implies there is actually something insecure about using it.

[throwawaymath]

Yeah you can use CORS securely, there are just pitfalls to look out for.