Planned lessonJNR-024-L04

CORS demystified

On This Lesson 4 topics

This lesson is planned. The outline below lists the topics it will cover. The full lesson has not been published yet.

In this lesson

understand why browsers block some cross-origin calls.

An origin is scheme + host + port. http://localhost:3000 and http://localhost:8080 are different origins.
Browsers apply the same-origin policy: a page may not read responses from another origin unless that server allows it.
CORS is how the server allows it, with headers such as Access-Control-Allow-Origin.
For some requests the browser first sends a preflight OPTIONS request to ask permission.
CORS is enforced by browsers only. It does not protect your server from curl or other programs.

Draft outline details

java

registry.addMapping("/**")
        .allowedOrigins("https://shop.example.com")
        .allowedMethods("GET", "POST", "PUT", "DELETE");

Does CORS stop a script on a server calling your API?

Show answer

No; only browsers enforce it.

Apply this lesson with the module's lab, exercises and quiz.

Marking a lesson complete is optional and you can undo it any time. Your progress stays in this browser.