As far as I understand, the Same Origin Policy exists to prevent authenticated requests from other origins.
So when a bad guy builds an evil website which tries to hijack the active authentication of my customers in order to manipulate or steal data on my server, my server can tell my customer's browser, that my server will not accept requests triggered from the evil website origin.
But I am wondering why the browser prohibits (SOP) all cross-domain requests when the receiving server does not respond with the correct CORS headers.
Question: Shouldn't it be safe to let the browser send 'zero-knowledge' requests without the authentication data, cookies, etc., that it knows from previous encounters with the domain? Like in incognito/anonymous browser mode or curl with a fresh cookie file?
That way cross domain communication would still work for servers without CORS headers and browsers would still prevent any authentication hijacking.