> CORS rules only prevent the JavaScript web client from reading the response

To nitpick, it’s the same origin policy that does that.