What is CORS?
CORS (Cross-Origin Resource Sharing) is a browser security mechanism that allows or restricts web pages from making requests to a domain different from the one that served the page, using special HTTP headers to control access.
How Does CORS Work?
By default, web browsers enforce a same-origin policy that prevents JavaScript on one domain from accessing resources on a different domain. CORS relaxes this restriction in a controlled way. When a web page makes a cross-origin request, the browser sends an HTTP request with an Origin header. The target server responds with Access-Control-Allow-Origin and related headers specifying which origins are permitted to access the resource.
For certain request types (such as those using PUT, DELETE, or custom headers), the browser first sends a preflight OPTIONS request to check whether the server allows the actual request. Proper CORS configuration is essential for modern web applications that consume APIs hosted on separate domains, load fonts from CDNs, or interact with third-party services. Misconfigured CORS headers are a common source of frustrating development errors and can also create security vulnerabilities if overly permissive.