What is Cross-Origin Resource Sharing?
A browser security mechanism that uses HTTP headers to tell web browsers whether a web application running at one origin has permission to access resources from a server at a different origin.
The Same-Origin Policy Enforcement
By default, web browsers enforce the Same-Origin Policy: JavaScript running on `https://site-a.com` is forbidden from reading API responses from `https://api-b.com` to protect users against unauthorized background session hijacks.
CORS provides a safe relaxation mechanism: the API server returns `Access-Control-Allow-Origin: https://site-a.com` headers, authorizing the browser to expose the response to client scripts.
Key Advantages & Impact
- Prevents malicious websites from making authenticated credentialed requests to bank or private SaaS APIs
- Enables modern decoupled frontend architectures (Next.js on Cloudflare/Vercel talking to AWS microservices)
- Offers granular control over allowed HTTP verbs (GET, POST), headers, and credential transmission
Common Misconceptions vs Reality
Frequently Asked Questions
Why do browsers send a preflight OPTIONS request?
For non-simple requests (such as requests sending JSON bodies or custom Authorization headers), the browser sends an OPTIONS request first to ensure the server understands and permits the operation before transmitting the real payload.