CORS

CORS is the browser mechanism that lets a server opt into cross-origin response reads. Simple requests may go directly; non-simple requests perform a preflight with method and header checks. Credentials require explicit origin reflection and cannot be combined with wildcard origins for credentialed reads.

					Access-Control-Allow-Origin: https://app.example.com
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: Content-Type, X-Request-Id
				

Preflight OPTIONS must return success before the browser sends the real request. Expose only headers the client must read.

On interviews: debug preflight failures, missing exposed headers, credentials, and wildcard mistakes.

Common pitfalls: adding Access-Control-Allow-Origin everywhere can expose private APIs. CORS errors in the console often hide the real server response.

The trade-off is convenience versus control — pick the mechanism that matches your coupling and performance budget.

Checklist:

• Know simple vs preflighted requests.
• Reflect specific origins with credentials.
• Expose only required response headers.
• Test with real browsers, not only curl.