CORS
InformationalCross-Origin Resource Sharing
Definition
Cross-Origin Resource Sharing (CORS) is an HTTP-header-based mechanism that lets a server indicate from which origins (domain, protocol, port) a browser may load resources. CORS relaxes the Same-Origin Policy in a controlled way, letting APIs be consumed by front-ends on different domains safely.
Impact
Lets APIs be consumed by frontends on other domainsA misconfiguration can expose private data to malicious sitesPreflight (OPTIONS) requests validate permissions before the real request is sentFundamental for modern architectures with separate frontend and backend
Examples
CORS headers and the preflight flow
When the browser detects a cross-origin request meeting certain criteria (custom headers, non-simple methods), it first sends an OPTIONS (preflight) request. The server responds indicating which origins, methods and headers are allowed.
# The browser's automatic preflight request OPTIONS /api/data HTTP/1.1 Host: api.example.com Origin: https://app.example.com Access-Control-Request-Method: POST Access-Control-Request-Headers: Content-Type, Authorization # Server response (secure configuration) HTTP/1.1 204 No Content Access-Control-Allow-Origin: https://app.example.com Access-Control-Allow-Methods: GET, POST Access-Control-Allow-Headers: Content-Type, Authorization Access-Control-Allow-Credentials: true Access-Control-Max-Age: 86400