🌐
CORS
Web Security
Cross-Origin Resource Sharing policy controlling cross-origin requests via response headers.
Definition
CORS uses HTTP headers to permit or deny cross-origin requests. Incorrect settings (e.g., wildcard origins with credentials) can enable data exposure.
In plain English
Cross-Origin Resource Sharing policy controlling cross-origin requests via response headers.
Why this matters
Why it matters: APIs that return personal data must enforce strict origin rules to prevent unintended disclosure.
Example
Example: Set Access-Control-Allow-Origin to a specific origin, avoid reflecting arbitrary origins, and carefully handle credentials.