What is CORS? Why my browser blocks my request

You have probably met that red error: "blocked by CORS policy". CORS is a browser security rule: a web page can read another site's response only if that site explicitly allows it.

Where does this rule come from?

Your browser is your doorman. When you are logged in to your bank in one tab, it does not want another site, open in a second tab, to read your information on your behalf.

So it applies a basic principle: a page only reads responses from its own origin. An origin is the combination of the protocol (https), the domain name and the port. If any one of the three changes, it is a different origin.

And when it is intended?

It is very common: your site mysite.com shows data coming from api.mysite.com. Two different origins, yet the same owner. There has to be a way to say "that one, I know it".

That is CORS (cross-origin resource sharing). The server adds headers, small labels, to its response that tell the browser which origins may read it. For some requests, the browser first asks the server (a "preflight" request) and only sends the real one after a favorable answer.

What CORS is not

• It is not a firewall. It protects the user inside the browser. Another program can call your API without going through it, so your API must check for itself who is allowed to do what.
• It is not a front-end bug. The permission is configured on the server. Changing the page's code fixes nothing.

The two classic mistakes

1. Allowing everything to make the error go away. It is handy in development, but it removes the protection. In production, list the origins you actually expect.
2. Mixing it with cookies. When requests carry the user's identity, the browser refuses a "allow everyone" permission: you must name the origins precisely.

Key takeaway

CORS does not block your application: it asks the server to say who may read its responses. Allow the origins you need, no more, and do not rely on it to protect your data.

And for your product?

An overly wide CORS setting, copied to "make a demo work", often reaches production without anyone coming back to it. It is the kind of detail a code audit of your application checks, along with the rest of your access rules. If you would like to talk about it, we can have a 30-minute conversation.

To go further: what an API is, database access rules and common flaws in AI-built apps.