Browser networking

Browser networking interviews focus on constraints servers ignore: CORS and preflight, SameSite cookies, mixed content, and credentialed fetch—why a curl works but the browser fails.

Subtopics: CORS and preflight requests, SameSite cookies, and mixed content.

On interviews: diagnose a blocked cross-origin POST, explain when preflight fires, and how cookie attributes affect session behavior across sites.

Common pitfalls: wildcard CORS with credentials, fixing CORS only in dev proxies, and HTTPS pages loading insecure scripts or APIs.

The trade-off is balancing simplicity, performance, safety, and operability — name which axis you optimized and what cost you accepted.

Checklist:

• Separate simple vs preflighted cross-origin requests.
• Set cookie attributes for your auth model.
• Enforce HTTPS for all active and passive subresources.
• Test credentialed flows in real browsers, not only curl.