State and browser security
Origins and CORS
Understand the browser same-origin policy, what makes two URLs different origins, and how servers opt in to cross-origin reads with CORS.
An origin is the combination of scheme, host, and port. These are different origins:
https://example.com
https://api.example.com
http://example.com
https://example.com:8443The same-origin policy stops browser scripts from freely reading data from another origin.
CORS lets a server relax that rule with response headers:
Access-Control-Allow-Origin: https://app.example.comFor some requests, the browser first sends an OPTIONS preflight. It asks whether the server permits the intended method and headers.
CORS is enforced by browsers. It does not prevent another server or curl from sending requests. It also does not replace authentication or authorization.
Lesson completed