Glossary
SECURITY HEADERS

CORS

Cross-Origin Resource Sharing — an HTTP header protocol that lets servers explicitly permit cross-origin fetch requests from browsers, overriding the same-origin policy.

CORS (Cross-Origin Resource Sharing, W3C spec) is a browser protocol that allows a server to explicitly opt in to receiving requests from a different origin. Without CORS, the browser’s same-origin policy blocks fetch() and XMLHttpRequest from reading responses across origins.

Header Format

Access-Control-Allow-Origin: https://app.example.com
Access-Control-Allow-Methods: GET, POST, PUT, DELETE
Access-Control-Allow-Headers: Content-Type, Authorization
Access-Control-Allow-Credentials: true
Access-Control-Max-Age: 3600

Preflight

For anything more than a “simple” request (GET/HEAD/POST with limited content types), browsers first send an OPTIONS preflight request. The server must respond with Access-Control-Allow-Methods and Access-Control-Allow-Headers matching the requested operation. If preflight fails, the real request never fires.

Common Misconfigurations

  • Access-Control-Allow-Origin: * combined with Access-Control-Allow-Credentials: true — the browser refuses the response. You must name the origin explicitly for credentialed requests.
  • Reflecting the request’s Origin header back without validation — silently accepts every origin, defeating the point
  • Missing preflight support — breaks any non-simple request

What CORS Is Not

CORS is not authentication and not authorization. It’s a browser policy for reading cross-origin responses. A curl or server-to-server call ignores CORS entirely.

Test your CORS behaviour with the security headers checker.

Check the CSP glossary entry, the Cookie SameSite entry, and read the HTTP security headers explainer.

← All terms Learning hub →