What is CORS? Does it protect an API from all clients?
Try code in the playgroundUnderstand the concept
CORS is a browser-enforced protocol that lets a server permit selected cross-origin response access. The browser checks response headers and may send a preflight request before the actual request. It is not a firewall: clients outside the browser can still call the API, and some cross-origin requests can be sent even without readable responses.
Important ideas
-
CORS tells browsers which origins may read cross-origin responses.
-
It does not stop server clients or replace authentication or CSRF protection.
-
Allow only needed origins, methods and headers for private browser APIs.
-
Credentialed browser requests need explicit permitted origins; a wildcard origin is not a substitute for that configuration.
Can you explain it without the notes?
What is CORS? Does it protect an API from all clients?
Use your own words. Explain an example and one limitation before checking the explanation.
Check your explanation
CORS is a browser-enforced protocol that lets a server permit selected cross-origin response access. The browser checks response headers and may send a preflight request before the actual request. It is not a firewall: clients outside the browser can still call the API, and some cross-origin requests can be sent even without readable responses.
Turn this concept into a clear answer.
- Explain who enforces CORS—the browser—and keep it separate from authorization and CSRF defenses.
Adapted from 02_NODE_EXPRESS_HTTP.md · “What is CORS? Does it protect an API from all clients?”. Examples are study fragments; framework behavior can depend on your version.