For security reasons and in order to protect end users, most browsers enforce the same-origin policy, which means that the browser will prevent scripts loaded from one origin (for example, http://127.0.0.1:8000) from making calls to a server of a different origin (for example, http://localhost:8080). To demonstrate why the same-origin policy is important, take a look at the following example.

Let's suppose you are logged in to your online banking site, personal.bank.io. Then, you open a malicious site, malicious.io, which runs the following script inside malicious.io:

fetch('personal.bank.io/api/transfer', {
  method : "POST",
  body : JSON.stringify({
    amount : '999999',
    to: 'malicious.io'
  })
})

If the same-origin policy was not in place and this request was allowed to proceed, then you would have lost a lot of money. Note that this is a variation on the Cross-Site Request Forgery (CSRF) attack we analyzed earlier.