🌐

CORS — Cross-Origin Requests

Medium

The Same-Origin Policy

Browsers enforce the Same-Origin Policy: JavaScript on app.frontend.com cannot read responses from api.backend.com — different origin (domain).

This protects you: without it, a malicious website could silently make API calls to your bank using your cookies and read the account balance.

CORS (Cross-Origin Resource Sharing) is the controlled exception — servers declare which origins are allowed.

Packets in motion — click to inspect:

1 / 6

Space to play/pause · ← → to step