CORS

Cross-Origin Resource Sharing is a browser security mechanism. By default a page may send a request to another origin but not read the response. CORS is the set of response headers by which the target server opts in, telling the browser that this particular origin is allowed to see the result.

How it works

For simple requests the browser sends the request, then withholds the response from the page unless Access-Control-Allow-Origin matches. For anything else — a custom header, a JSON content type, a method beyond GET/POST/HEAD — the browser first sends an OPTIONS preflight and only proceeds if the answer permits the method and headers it intends to use. Credentials require both Access-Control-Allow-Credentials and a specific origin, never the wildcard.

The misconception

That a CORS error means the request failed. Usually it succeeded — the server received it, acted on it and answered — and the browser refused to hand the response to your code. A "CORS error" on a POST can mean the record was created and you simply cannot see the confirmation. It is also not a server-side protection: anything that is not a browser ignores CORS entirely.

Try it here

Run any request in Live API mode from your own page and watch the preflight. A missing OPTIONS handler surfaces as a CORS failure in the console and a plain 405 in the network tab.

Related

• HTTP 405 Method Not Allowed
• How the live API is served

Other terms

• Mock API — A stand-in for a real API that returns realistic responses without the real system behind it.
• REST API — An API that models a system as addressable resources, manipulated with standard HTTP methods.
• ETag — An opaque version identifier for a representation, used to avoid re-sending it and to detect conflicting writes.
• HATEOAS — Hypermedia as the Engine of Application State — responses carry the links to whatever you can do next.
• Bearer token — A credential where possession alone grants access — whoever holds it can use it.
• JWT (JSON Web Token) — A signed, self-contained token whose payload the server can verify without a database lookup.

All glossary terms · Testing techniques · All 39 mock REST APIs