Ah, I missed it!

Another exercise could be to have a page where the Access Control Allow Origin is set to a specific domain, then make a request by setting a different origin.

E.g:

  curl -H "Origin: https://wrong.origin.com" https://httpbin.org/anything

Many people think CORS is enforced by the server.