CORS explained
Why browsers block cross-origin requests and how CORS lets servers allow them: the same-origin policy, simple and preflighted requests, the Access-Control headers, credentials and cookies, configuring CORS in Express, Spring and Nginx, and debugging the famous console error.
CodexBash, , 5 min read
Sooner or later every web developer sees this in the browser console: "Access to fetch at 'https://api.example.com' from origin 'https://app.example.com' has been blocked by CORS policy." The request worked in Postman and in curl, so what is wrong? The answer is that browsers enforce a security rule called the same-origin policy, and CORS (Cross-Origin Resource Sharing) is the way a server tells the browser which other sites may read its responses. This article explains both, how the browser decides, and how to configure it correctly without opening a security hole.
Sign in to read the rest
The whole 5 minute article is free with an account, along with every problem, lesson and tutorial. No card.