Cross-Origin Resource Sharing

Allowing another origin to read responses

Cross-Origin Resource Sharing, or CORS, is an HTTP-header mechanism. A server uses it to indicate which other origins may access its responses from browser code. An origin includes scheme, host and port. Enforcement happens in the browser; CORS is not an API login.

Consider the portal and API separately

A fictional portal at https://portal.example wants to read project data from https://api.example/projects. The API can allow the portal origin through Access-Control-Allow-Origin. Depending on the method and headers, the browser first asks with OPTIONS whether the actual call is permitted. This check is called a preflight; it does not happen for every call.

For other calls, the request may already reach the server even though the browser subsequently withholds the response from the script. A CORS error therefore does not prove that nothing happened on the server.

If session cookies are to be included, credential settings must also agree. Such responses require an explicit origin rather than the wildcard *; Access-Control-Allow-Credentials is relevant too. The browser’s cookie rules still apply. Independently, the API checks identity and permissions for the requested project data.

Sources

• MDN — Cross-Origin Resource Sharing