State and browser security

Origins and CORS

Understand the browser same-origin policy, what makes two URLs different origins, and how servers opt in to cross-origin reads with CORS.

9 minute lesson

~~~

An origin is the combination of scheme, host, and port. These are different origins:

https://example.com
https://api.example.com
http://example.com
https://example.com:8443

The same-origin policy stops browser scripts from freely reading data from another origin.

CORS lets a server relax that rule with response headers:

Access-Control-Allow-Origin: https://app.example.com

For some requests, the browser first sends an OPTIONS preflight. It asks whether the server permits the intended method and headers.

CORS is enforced by browsers. It does not prevent another server or curl from sending requests. It also does not replace authentication or authorization.

Lesson completed