CORS
acronymweb devsecurity
Stands for: Cross-Origin Resource Sharing
The browser mechanism that decides whether a web page may make requests to a different origin.
By default the same-origin policy blocks a page on one site from reading responses from another; Cross-Origin Resource Sharing is how a server opts to allow specific cross-origin access. For anything beyond the simplest requests, the browser first asks permission with a preflight - an OPTIONS request the server must answer correctly before the real one is sent. Misunderstanding that two-step dance is behind a large share of "blocked by CORS" developer headaches.
CORS is a browser mechanism, and understanding that one fact resolves most confusion about it. It does not protect your server; it protects users from having their credentials silently used by a site they did not intend to authorize. The same-origin policy blocks cross-origin reads by default, and CORS is the controlled exception a server can grant.
The preflight is what surprises developers. For anything beyond simple requests, the browser first sends an OPTIONS request asking whether the actual request is permitted, and only proceeds if the response says yes. So a failing request that never appears in your server logs as the expected method is usually a preflight that was refused or mishandled.
The dangerous misconfiguration is reflecting the requesting origin while allowing credentials. The specification forbids the wildcard together with credentials for good reason, and echoing back whatever origin asked achieves the same effect while evading the check. That combination means any site can make authenticated requests to yours and read the answers, which is the vulnerability CORS exists to prevent rather than a way to satisfy it.
Also known as: cors, cross-origin resource sharing, same-origin policy