Cross-Origin Resource Sharing (CORS) Security Specifications
Cross-Origin Resource Sharing (CORS) is a browser-enforced security standard defined by the W3C WHATWG Fetch standard. By default, web browsers apply the Same-Origin Policy (SOP), preventing JavaScript code running on one domain (e.g. https://app.example.com) from reading HTTP responses from a different origin (e.g. https://api.backend.com) without explicit server permission.
The Anatomy of CORS Preflight Requests
When client JavaScript issues a non-simple HTTP request (e.g. using custom headers like Authorization: Bearer <token> or methods like PUT/DELETE), modern browsers automatically dispatch an OPTIONS preflight request before sending the actual payload. The server must respond with appropriate Access-Control-Allow-* headers or the browser aborts the request with a console CORS error.
Example Nginx CORS Server Configuration
# Enable CORS in Nginx add_header 'Access-Control-Allow-Origin' 'https://app.example.com' always; add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS' always; add_header 'Access-Control-Allow-Headers' 'Authorization, Content-Type' always; if ($request_method = 'OPTIONS') { add_header 'Access-Control-Max-Age' 1728000; return 204; }Developer & Security Tool Suite
Audit your server headers and API endpoints:
- Security Header Auditing: Inspect CSP and HSTS with our Security Headers Checker.
- HTTP Status Diagnostics: Test status codes with our HTTP Status Checker.
- Cookie Security: Audit SameSite flags with our Cookie & SameSite Inspector.
Frequently Asked Questions
Why does my API work in Postman or cURL but fail in the browser?
Postman and cURL are developer CLI tools that do not enforce the browser Same-Origin Policy. CORS restrictions are strictly enforced by web browsers to protect end users from cross-site data theft.
Is Access-Control-Allow-Origin: * safe for authenticated APIs?
No. Using a wildcard * origin on endpoints that handle user credentials or session cookies is prohibited by modern browsers and introduces significant cross-site data leak vulnerabilities.