Cross-Origin Resource Sharing (CORS) is a security feature implemented by web browsers to prevent malicious websites from accessing resources on other domains without permission.
Important Notes:
- CORS headers must be set by the server, not the client
- Preflight requests (OPTIONS) are sent for non-simple requests
- You cannot use wildcard (*) origin with credentials
- Multiple origins require dynamic origin checking on the server
- Some browsers cache preflight responses based on Max-Age
Common Issues:
- Missing OPTIONS handler for preflight requests
- Not including credentials when needed
- Forgetting to expose custom response headers
- Setting multiple origins in a single header (invalid)
