Isn't CSP controlling what you can fetch FROM your website? The proxy in the example I mentioned can act as a simple web browser behind the scenes. Unless I'm missing something.
Would be an additional method.
Your attack is not new/novel.
It's not a bad idea to just put in a CSP (always put in a CSP!), CORS policy, and Same-Origin. This is configured on your app rather than server (usually).
MDN is one of the better resources for this, and links out to other authoritative resources in the additional info section of a directive.