CORS (Cross-Origin Resource Sharing)
CORS is a browser mechanism that controls which origins (domains) can make requests to your API. Without CORS headers, browsers block cross-origin XMLHttpRequest and fetch() calls. The server responds with Access-Control-Allow-Origin to permit specific origins. Misconfigured CORS (Allow-Origin: *) can expose APIs to credential theft.
Definition
Cross-Origin Resource Sharing relaxes the Same-Origin Policy – the browser security model that prevents site-a.com's JavaScript from reading responses from site-b.com's API. When a page at origin A makes a fetch() to origin B, the browser sends the request but blocks the response unless B's response includes Access-Control-Allow-Origin: A (or *). Preflight requests (OPTIONS) are sent for non-simple requests (custom headers, PUT/DELETE methods) to check permissions before sending the actual request. CORS is enforced by the browser only – curl, Postman, and server-to-server calls ignore CORS entirely. Common misconfiguration: reflecting the Origin header back as Allow-Origin with Allow-Credentials: true – this lets any site steal authenticated data. Use an explicit allowlist of origins, never reflect arbitrary origins with credentials.
Examples
- –Access-Control-Allow-Origin: https://app.example.com
- –Access-Control-Allow-Methods: GET, POST, PUT
- –Access-Control-Allow-Credentials: true (DANGEROUS with wildcard origin)
Related Protocols
Related Terms
CSP (Content Security Policy)
CSP is an HTTP header that restricts which resources (scripts, styles, images, frames) a page can load. CSP mitigates XSS by preventing execution of inline scripts and scripts from unauthorized origins. A strict CSP (script-src 'nonce-random') blocks injected JavaScript even if an attacker finds an injection point.
XSS (Cross-Site Scripting)
XSS is a vulnerability where an attacker injects malicious JavaScript into a web page viewed by other users. Stored XSS persists in the database (comments, profiles). Reflected XSS arrives via URL parameters. DOM-based XSS executes entirely client-side. XSS enables session hijacking, credential theft, and defacement.