Is it possible to cross-origin request a VKontakte api site?

Question

In contact with

Is it possible to cross-origin request a VKontakte api site or only using jsonp?
The page from which the request is made loads with the title
Access-Control-Allow-Origin: *
But chrome gives an error

XMLHttpRequest cannot load https://api.vk.com/method/friends.get?order=hints
&fields=first_name%2Clast_…5b8d8e7bb205aafc518829b2c2f07205b4a91.
No 'Access-Control-Allow-Origin' header is present on the requested resource.
Origin 'http://ze…com' is therefore not allowed access.

Making requests through the server is a slow option that violates the user's privacy. Although having an access_token on the server, nothing prevents me from doing them myself)
Actually, I wanted to make all requests using the POST method to avoid problems with caching, there are times when someone sets up a proxy crookedly)

Answer 1

Access-Control-Allow-Origin: * is the header that is returned along with the response to the Cross-Domain request. So that your chrome does not display an error, it is necessary that not the page from which the API twitches was loaded with this header, but the VK API answered you with this header. In your case only JSONP

Answer 2

Although having an access_token on the server, nothing prevents me from doing them myself)

It interferes with limiting the number of requests from vk.