Cross-Origin Resource Sharing (CORS)

Updated 18 Sep 2026

•
What it is
- •
  an HTTP-header mechanism through which a server permits browser scripts from specified origins to access responses
•
Fields
- •
  Access-Control-Allow-Origin — permitted origin
- •
  Access-Control-Allow-Methods — permitted methods for preflighted requests
- •
  Access-Control-Allow-Headers — permitted request headers for preflighted requests
- •
  Access-Control-Allow-Credentials — permission for credentialed response access
•
Preflight
- •
  the browser sends an OPTIONS request before certain cross-origin requests to check permission
•
Caution
- •
  credentialed access cannot use wildcard Access-Control-Allow-Origin: *
- •
  CORS is enforced by browsers; it is not authentication or protection against arbitrary nonbrowser clients
•
Source
- •
  https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CORS
•
Related
- •
  Same-Origin Policy

Linked references 2