I thought same origin implies no CORS, and vice-versa. What's the difference between the two options for JavaScript's Fetch API's mode option?
Also, in the specs, it says:
Even though the default request mode is "no-cors", standards are highly discouraged from using it for new features. It is rather unsafe.
Why is it unsafe? Source: https://fetch.spec.whatwg.org/#requests