What is the purpose of the "Javascript Origins" when creating a Client ID
<p>When you create a Google API credential for a web app, you indicate allowed Javascript Origins which is just a list of URIs.  I'm trying to understand what the purpose of these is.</p>

<p>The implication is that any JS code that presents the client ID has to be sourced from the allowed origins to access Google's APIs (such as the Calendar API or Google+ API).  But how does that help?</p>

<ol>
<li><p>The Client ID is public knowledge and spoofing the origin would be trivial for malicious code.</p></li>
<li><p>The first thing I do is add "<a href="http://localhost:8080" rel="nofollow">http://localhost:8080</a>" so I can run code from my development environment but of course every computer self identifies as "localhost" so I've effectively negated any security from it.</p></li>
</ol>

<p>What is the point of it?</p>

<p>Thanks in advance!</p>