CORS controls how browsers allow cross-origin requests between different domains.
How CORS Works
Browser (https://app.com) Server (https://api.com)
│ │
│──── Preflight (OPTIONS) ──────────▶│
│ Origin: https://app.com │
│ Access-Control-Request-Method │
│ │
│◀─── CORS Headers ─────────────────│
│ Access-Control-Allow-Origin │
│ Access-Control-Allow-Methods │
│ │
│──── Actual Request (POST) ────────▶│
│ Origin: https://app.com │
│ │
│◀─── Response + CORS Headers ──────│
Simple vs Preflight Requests
Loading code block...
Express CORS Configuration
Loading code block...
Manual CORS Headers
Loading code block...
Common CORS Headers
Loading code block...
Credentials and Cookies
Loading code block...
Common Issues
Loading code block...
Debugging CORS
Loading code block...
CORS protects users by restricting cross-origin requests. Configure it properly for security and functionality.