No, It's Not a CORS Error
summary
Shows why browser CORS errors often mask the real cause by demoing a simple frontend with a misconfigured Rust backend and an API gateway that alters preflight behavior and headers. Demonstrates that browsers will block requests even when the server returns 200/500, that intermediaries can overwrite Access-Control-Allow-Origin and drop headers, and that missing or changed Access-Control-Allow-Methods or preflight responses produce silent failures. Recommends inspecting F12 network headers (curl bypasses CORS) and ensuring the called service emits the correct CORS headers.
AI-written summary · about
chapters (6)
- 0:00Introduction
- 1:03CORS necessity
- 2:48CORS request types
- 4:33Practical demo
- 11:23Misleading CORS errors
- 12:07Best practices
related talks
14mNo, It's Not a CORS Error
41mHow About a Tour of CORS?
26mTalking to Browsers with CORS
13mCORS: Cross-domain requests with JavaScript
40mMisconfigured CORS and why web appsec is not getting easier
37mA Hipster History of CORS
25mWe Still Don’t Have Secure Cross-Domain Requests: an Empirical Study of CORS
42mBuilding modular, scalable web apps? of CORS!