www.example.com gives you a html page, that wants to fetch from other.example.com.
But if other.example.com doesn’t allow www.example.com, the web browser won’t make the request. This is CORS (Cross orgin resource sharing)
CORS can be setup in bucket permissions