What is CORS?

CORS stands for Cross-Origin Resource Sharing. It is a browser-based security feature that controls how web pages from one origin (scheme, host, and port) can request resources from a different origin. Without CORS, browsers enforce the same-origin policy, which blocks cross-origin requests to prevent malicious sites from reading sensitive data from another site. CORS provides a safe way to relax this restriction when the target server explicitly opts in.

When a browser makes a cross-origin request (for example, a script on https://example.com fetching data from https://api.example.org), the browser adds an Origin header to the request. The server responds with one or more CORS headers, most notably Access-Control-Allow-Origin. If the server's response includes the requesting origin (or a wildcard *), the browser allows the page to read the response. For certain requests that are not simple (like those with custom headers or methods other than GET/POST), the browser first sends a preflight OPTIONS request to check permissions before sending the actual request. The preflight uses headers like Access-Control-Request-Method and Access-Control-Request-Headers, and the server must respond with matching Allow headers.

CORS is a server-driven policy, not a client-side fix. It is widely used for public APIs, CDN-hosted fonts, and web applications that consume third-party services. Misconfiguration can lead to security vulnerabilities, such as using a wildcard origin with credentials (which browsers block) or reflecting arbitrary origins without validation. Proper CORS setup requires careful consideration of which origins, methods, and headers are allowed, often documented in the server's configuration or middleware.