CORS Explained: Same-Origin Policy and Preflight Requests

CORS — Cross-Origin Resource Sharing — is how browsers let scripts make cross-origin requests safely. The baseline Same-Origin Policy blocks script from reading a response if the response's origin (scheme + host + port) doesn't match the requesting page's origin. This exists so malicious code on evil.com can't run fetch("https://bank.com/api/balance") and read your logged-in bank account. CORS relaxes this when the target server opts in via specific response headers. There are two flavors of cross-origin requests. Simple requests are GET/HEAD or POST with content-type in a safe list (application/x-www-form-urlencoded, multipart/form-data, text/plain) and no custom headers like Authorization. The browser sends the actual request directly with an Origin header. The server can respond with Access-Control-Allow-Origin: https://a.com (or *). If the header matches, JS can read the response; if not, the browser blocks it — though note the request did reach the server. Preflighted requests are anything else: PUT, DELETE, PATCH; or Content-Type: application/json; or custom headers like Authorization. The browser first sends an OPTIONS request with Access-Control-Request-Method: PUT and Access-Control-Request-Headers: Authorization, Content-Type. The server must respond with Access-Control-Allow-Methods: PUT, POST, Access-Control-Allow-Headers: Authorization, Content-Type, and Access-Control-Allow-Origin. If these match what the preflight asked for, the real request fires. Otherwise the browser aborts. Preflights can be cached for Access-Control-Max-Age seconds so subsequent identical requests skip them. Credentials — cookies, HTTP Basic auth, TLS client certs — are not sent cross-origin by default. To include them: client must set fetch's credentials: "include" (or XHR's withCredentials = true), AND the server must respond with Access-Control-Allow-Credentials: true, AND Access-Control-Allow-Origin must be the specific origin — wildcard * is rejected for credentialed requests. This trio is the source of the most common CORS bug in production. Also note: CORS is enforced by the browser; a server making the same cross-origin HTTP call from Node has no CORS concerns because no browser is involved.