That's absolutely not true. The standard for new vaccines, iirc, required a period of something on the order of 7 years. Time, in this case, is not a function of procedure that can be expedited in an emergency, but is actually an important element in and of itself. Many issues do not manifest immediately and actually need follow up over time.

The crazy thing about these vaccines was that both mRNA vaccines and the viral vector vaccines were completely new platforms, never deployed at scale. They work entirely differently than all other vaccines. Up until this point, vaccines all delivered the antigen in one of 3 ways: you get a weakened virus, you get a dead virus, or you get the antigen itself (subunit protein like Novavax). Both the mRNA (Pfizer & Moderna) and the viral vector (J&J) vaccines worked by getting either mRNA or DNA (viral vector) into your cells, and then having your own cells produce and express the antigen themselves. Basically the difference between server generated code or shipping the JS for you to run the SPA on your own client.

One of the crazy things about this was that it wasn't obvious what the implications would be of having our own cells expressing the antigens (and thus flagging themselves for destruction by our immune system). This was particularly concerning because the cells that were shown to be doing this, despite the complete lie that kept being repeated of the vaccine staying localized at the injection site, were found all over the body. In the case of the viral vector vaccines, at least they were being delivered by a vessel (living adenovirus) that our bodies have had billions of years of evolution to determine where they might end up. In the case of the mRNA vaccines, though, the vessel was a lipid nanoparticle with an exceptional ability to deliver payloads basically anywhere in the body. Note: the attention these lipid nanoparticles had received prior to their use in mRNA was their ability to deliver payloads to places that are notoriously difficult to reach, notably their ability to cross the brain blood barrier. So you have delivery mechanisms delivering a payload that makes our cells into antigen factories, shown to be producing them all over the body, and targeting themselves for destruction by the immune system/causing an increased immune response in these areas.

And then, for the icing on the cake, there was mounting evidence that the antigen itself was actually likely destructive/problematic.

I could go off forever on this topic. The amount of obfuscation and gaslighting was insurmountable for anybody that was even remotely interested in figuring out what was happening. From a personal perspective, my trust in many institutions was permanently shaken.

TL;DR: It's a restriction your browser gives itself. If it's on Domain A and it sees a request going out to Domain B, unless Domain B responds saying that it's expecting traffic from Domain A, the browser prevents itself from making the call.

I think the part about it that is off/silly to most people is that it's not a normal security threat model, because a malicious client could simply just...not impose that restriction on itself. You're perfectly capable of going and curling that same request to that backend, or calling it from an app, or any number of other things. So it's not really protecting your protected resource, the backend, from malicious clients.

All of that is where I feel like I understand clearly. The part I fail to retain is the exact scenarios it does protect against, which IIRC, are basically about attempting to protect your users from being misguided on other clients that are acting as your client, something like that (but again, this literally only applies to browsers). It's just kind of a weird niche problem that I often find myself thinking "I mean why is the user on another client and have allowed themselves to authenticate on that client with my server...this sounds like the user's fault."

There were definitely many keygens I would open just to have on in the background.

The human mind is capable of the same thing, you know? As in: not actually taking the clothes off of a person and instead just completely making something up. I hereby give permission to all AI, and human minds, to completely make up what I look like naked.

PaymentIntents is definitely a Stripe abstraction, however, but that's one that I like. It's been a while since I used it, but I remember liking that it allowed me to bundle up everything related to the payment, i.e. the amount, the payment method, etc, and pass it around between server, client, and different views in the client, such that you could really build the exact payment flow you want without touching PCI data.

The Stripe abstractions I have always felt are much clunkier are the distinctions between Products/Prices/Subscriptions/SubscriptionSchedules, etc. A lot of "what lives where?" with those; very clunky to work with.