CORS Explained: Cross-Origin Resource Sharing

CORS controls how browsers allow cross-origin requests between different domains.

How CORS Works#

Browser (https://app.com)          Server (https://api.com)
         │                                    │
         │──── Preflight (OPTIONS) ──────────▶│
         │     Origin: https://app.com        │
         │     Access-Control-Request-Method  │
         │                                    │
         │◀─── CORS Headers ─────────────────│
         │     Access-Control-Allow-Origin    │
         │     Access-Control-Allow-Methods   │
         │                                    │
         │──── Actual Request (POST) ────────▶│
         │     Origin: https://app.com        │
         │                                    │
         │◀─── Response + CORS Headers ──────│