title: Why do browser APIs restrict cross-domain requests?
body: <p><code>XMLHttpRequest</code>s require CORS to work cross-domain. Similarly for web fonts, WebGL textures, and a few other things. In general all new APIs seem to have this restriction.</p>
  
  <p>Why?</p>
  
  <p>It's so easy to circumvent: all it takes is a simple server-side proxy. In other words, server-side code isn't prohibited from doing cross-domain requests; why is client-side code? How does this give any security, to anyone?</p>
  
  <p>And it's so inconsistent: I can't <code>XMLHttpRequest</code>, but I can <code>&lt;script src&gt;</code> or <code>&lt;link rel&gt;</code> or <code>&lt;img src&gt;</code> or <code>&lt;iframe&gt;</code>. What does restricting XHR etc. even accomplish?</p>