his request, <code>bank.example.com</code> must allow <code>attack.example.com</code> to perform cross origin requests.
This is where CORS comes in. If we were serving <code>bank.example.com</code> in an Istio enabled cluster, we could configure a <code>corsPolicy</code> to allow this:</p><pre><code class=language-yaml data-expandlinks=true data-repo=istio>apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: bank
spec:
  hosts:
  - bank.example.com
  http:
  - corsPolicy:
      all