CORS and JWT are complete different things.

JWT stands for JSON Web Tokens and is a token based authentication defined by RFC 7519. So a JWT token is used to allow access (login) to web resources. You can also add information to the token (like username), which can be read openly if unencrypted. But JWT has a signing method, so one can verify the token is valid. There's different crypto algorithms that can be used like e.g. RSA. You have the choice between asymmetrical signature (e.g. RSA) or symmetrical signing (e.g. HS256).

You can find information about JWT at jwt.io

CORS stands for Cross-Origin Resource Sharing and defines how the browser is allowed to ask requests across resources or to say it in other words: HTTP access to other domains.

In my opinion mozilla did a good job in covering CORS pretty well: https://developer.mozilla.org/de/docs/Web/HTTP/CORS

To your specific problem: You are trying to access a resource (http link) that doesn't belong to the same domain and thus your browser is not allowing to open it for security reasons.

allow-origin is a HTTP header and is set at the webframework your using. As Django doesn't come with CORS out of the box you will need some addition like https://github.com/ottoyiu/django-cors-headers

Once installed you can enable CORS

CORS_ORIGIN_ALLOW_ALL = True

and enable the cross domain requests you'd like to call:

CORS_ORIGIN_WHITELIST = (
    'host1.example.com',
    'host2.example.com',
    'host3.foobar.info'
)

Both are different

CORS(Cross-Origin Resource Sharing) enables resource sharing between a client browser and a server having a different origin, this allows to stop or allow request from a client to the server.

JWT is a way to add security to your application, you can use JWT to identify users, that way, the server only sends responses to the users who has a valid JWT, read more about it here

• Answer 1: CORS must be enabled in the backend, in the frontend you could use axios to perform http request, it will add the required headers

• Answer 2: By not enabling CORS, requests from a client (people around the world visiting your website/application) will be rejected, so your application can be used only from the host machine, anyway, JWT doesn't add anything in this case, JWT is used to identify a valid user, a user with access to the server resources. Enabling CORS, and accepting requests, without JWT, means that your application/website doesn't use an authentication system and doesn't need to validate the user identity. There are other ways to identify users, JWT is only one of them.

• Answer 3: To avoid malicious requests, a security layer must be added, that way only allowed users can reach the server resources.