Glossary

CORS

CORS (Cross-Origin Resource Sharing) is a browser mechanism that allows or blocks JavaScript on one domain from making requests to another. The browser checks the server's response headers and decides whether client-side code may access the data.

How it works

For "non-simple" requests (POST with JSON, custom headers) the browser first sends a preflight request using the OPTIONS method. The server returns headers allowing or blocking the request. If allowed — the browser sends the actual request.

Key headers

Access-Control-Allow-Origin — domain(s) permitted access (* or a specific domain)
Access-Control-Allow-Methods — allowed HTTP methods
Access-Control-Allow-Headers — allowed request headers
Access-Control-Allow-Credentials — whether cookies may be sent with the request

Server-side configuration

CORS headers are set by the server — through middleware, Nginx/Apache configuration, or directly in code. A "blocked by CORS policy" error is always resolved on the server side, not the client.