CORS (cross-origin resource sharing)

In short: By default browsers do not allow a page’s scripts to read responses from another origin (domain, port, protocol). CORS is the mechanism with which a server allows this deliberately.

In more detail: The rule is called the same-origin policy. With the response header Access-Control-Allow-Origin a server declares that a certain foreign origin may access it. For requests with special methods or headers the browser sends a “preflight” request (OPTIONS) beforehand.

In Depth

• Frequent error: “blocked by CORS policy” in the console. The cause lies with the server, not in the browser code.
• * with cookies: A wildcard for the origin is not allowed for requests with credentials.
• No protection of the server: CORS protects users in the browser. A program outside the browser ignores it.
• Protection against CSRF: It is not; for that you need CSRF protection.
• Public files: Fonts and program files that other sites should load need appropriate headers.

See also: Security headers (HSTS, CSP and more), REST