What is CORS? Does it protect an API from all clients?

Definition:

CORS is a browser-enforced protocol that lets a server permit selected cross-origin response access. The browser checks response headers and may send a preflight request before the actual request. It is not a firewall: clients outside the browser can still call the API, and some cross-origin requests can be sent even without readable responses.

Key points:

• CORS tells browsers which origins may read cross-origin responses.

• It does not stop server clients or replace authentication or CSRF protection.

• Allow only needed origins, methods and headers for private browser APIs.

• Credentialed browser requests need explicit permitted origins; a wildcard origin is not a substitute for that configuration.

Interview point:

• Explain who enforces CORS—the browser—and keep it separate from authorization and CSRF defenses.