How About a Tour of CORS?
summary
A practical walkthrough of Cross-Origin Resource Sharing using an Express app and cors middleware: a single-page app fetches a cheeses API and also requests an avatar with credentials, demonstrating how CORS errors occur and how to fix them. It explains that browsers enforce CORS, that preflight requests use OPTIONS and must echo allowed methods and headers, that using a wildcard Origin fails when credentials are sent, and recommends setting the Vary: Origin header; demos and checks use fetch, browser DevTools, and curl.
AI-written summary · about
chapters (9)
- 0:00Start
- 3:38same-origin policy
- 16:03Access-Control-Allow-Origin
- 25:36How It Works
- 26:53Request Headers
- 27:33Response Headers
- 33:08Debugging
- 38:17Related Topics
- 40:19References
related talks
13mCORS: Cross-domain requests with JavaScript
26mTalking to Browsers with CORS
15mNo, It's Not a CORS Error
37mA Hipster History of CORS
40mMisconfigured CORS and why web appsec is not getting easier
25mWe Still Don’t Have Secure Cross-Domain Requests: an Empirical Study of CORS
52mThe Past, Present, and Future of Cross-Site/Cross-Origin Request Forgery
52mThe Past, Present, and Future of Cross-Site/Cross-Origin Request Forgery