can someone explain CORS to me? let's take the example domain X dot com, X being a placeholder since nobody would be dumb enough to call their company that.

anyway, X dot com uses api.x[.]com for their API when I'm on that site and my browser blocks that. would that be okay according to CORS? why is it being blocked, it's the same domain?