Why isn't cross origin policy enforced?

Question

I have this code:

       $.getJSON("https://restcountries.eu/rest/v2/name/" + $("#nameOfCountry").val(),
        { fullText: "true" }, function (data) {
            console.log(data[0]);
            $('#answer').html(data[0].capital);
       });

I get the response from the other server. So my question is: why doesn't the browser enforce the cross origin policy here?

Answer 1

The Same Origin Policy is never enforced by the server. It is enforced by the browser.

In this case, the server has used the CORS standard to include an Access-Control-Allow-Origin header that tells the browser that it has permission to share the data with any other site.