Cross-Origin Resource Sharing (CORS)

A browser-enforced mechanism that lets a server declare which other origins may read its responses.

Configure CORS on the server that owns the resource; adding a header to the frontend cannot bypass the browser policy.

webcorshttpbrowserapi

Response headers (http)

Access-Control-Allow-Origin: https://app.example.com
Access-Control-Allow-Methods: GET, POST
Access-Control-Allow-Headers: Content-Type, Authorization
Vary: Origin

CORS applies to browser JavaScript reading a response across origins. It is not an authentication system and does not restrict server-to-server requests.

Non-simple requests may trigger an OPTIONS preflight. The server must answer that preflight with the allowed origin, methods, and headers before the browser sends the actual request.

Common mistakes

Using * with credentials; browsers reject that combination.
Forgetting Vary: Origin when responses differ by requesting origin.
Trying to fix CORS in client code instead of configuring the API.

HTTP 204 No Content Content-Security-Policy (CSP)SameSite Cookie Attribute

Sources

MDN Web Docs: HTTP