Cross-Origin Resource Sharing (CORS)

CORS is a browser-enforced mechanism that lets an API specify which web origins may read its cross-origin responses. It is not a substitute for authentication, authorization, or other API security controls.

An origin is the combination of scheme, host, and port. A request is cross-origin when its origin differs from the origin of the page making it. Browsers restrict JavaScript from reading many cross-origin responses unless the server grants access with Cross-Origin Resource Sharing (CORS) response headers.

The API indicates allowed origins with headers such as `Access-Control-Allow-Origin`. For requests that use credentials, such as cookies, the server must explicitly allow the requesting origin and include `Access-Control-Allow-Credentials: true`; a wildcard origin cannot be used for that case. The browser, rather than the server, enforces whether page scripts can read the response.

For some requests, the browser first sends a preflight `OPTIONS` request describing the intended method and headers. The server's response must permit them, typically using `Access-Control-Allow-Methods` and `Access-Control-Allow-Headers`, or the browser will not send the actual request. Simple requests may be sent without preflight, even if the browser later blocks JavaScript from reading the response.

CORS is not a mechanism for authenticating callers or preventing all requests from reaching an endpoint. A non-browser client can send requests regardless of CORS headers. APIs still need appropriate authentication, authorization, input validation, and protections against threats such as cross-site request forgery where relevant.

Key points

• CORS is a browser-enforced policy for cross-origin web access.
• Servers grant browser access using CORS response headers.
• Some requests trigger an `OPTIONS` preflight before the actual request.
• Credentialed requests require an explicit allowed origin, not `*`.
• CORS does not replace API authentication or authorization.

Interview questions

Does CORS protect an API from unauthorized clients?

No. CORS is a browser policy governing whether web page scripts may access cross-origin responses; it does not authenticate callers or generally stop requests from being sent. A command-line tool or another server can call the endpoint without enforcing CORS. The API must still use authentication and authorization, and should consider CSRF defenses when browser credentials are involved.

What is CORS, and what does an origin mean?

An origin consists of scheme, host, and port, so changing any of those makes a request cross-origin. Browsers restrict scripts from reading cross-origin responses by default. CORS is a server-provided set of response headers that tells the browser which origins and request characteristics are permitted.

What is a CORS preflight?

A preflight is an `OPTIONS` request the browser sends before certain cross-origin requests. It communicates the intended method and headers, and the server responds with permissions such as allowed methods and headers. If the preflight fails, the browser does not send the actual request; requests that do not require preflight can still be sent, though their responses may be unreadable to page JavaScript.

How should an API configure CORS for requests that include cookies?

For a credentialed request, the server must return an explicit allowed origin rather than `*`, and it must opt in with `Access-Control-Allow-Credentials: true`. The browser checks these headers before exposing the response to the requesting page. Credentials may include cookies or other browser-managed credentials, depending on the request.