CORS headers are only honored by supported User Agents (UA from now on). The responsibility of a web developer is to set the appropriate CORS headers for every response, and it will be the responsibility of the UA to enforce such headers and block the access if the headers are going to be violated.
Any request made by the UA will fall in only 1 of 2 categories regarding CORS:
- Basic requests that don't require any special treatment
- More complex requests that require some special treatment
The process that decides in what category a request ends up depends only on the http request (if it has a payload, the http method, cookies, other headers...) and is decided by the UA and written in the RFC.
If the original request requires some special treatment, then the UA will perform 1 more request before the original http request, that second request has an OPTIONS method to the same URI of the original http request and is only done to get the CORS headers that will apply to the original request in order to make the decision to allow or deny the original request.
Now regarding your questions:
However, for a POST request, for instance, if the origin is not allowed, should the request be blocked or is already too late at that point?
Since a POST requests is always a request that requires special treatment, it will get denied after the OPTIONS request (also called preflight request) is done if the CORS headers deny the request.
It is possible that a server does the request, so CORS does not apply at all and no origin is set so it cannot be done.
Yes, if a server is doing a CORS request, then it's his responsibility to honor it since it has become the UA of that http request.
So, this only truly applies to browsers (as far as I know).
Kind of correct, it applies to any UA that honors CORS headers, and that is usually a browser, but doesn't have to be per se.
So, perhaps when this happens the browser is already so far gone that this is already too late.
This can never happen for special treatment requests, since a browser that supports CORS will only make a request once the preflight request has allowed him to do so.