Cross-Origin Resource Sharing (CORS)

Welcome! Today we'll explore Cross-Origin Resource Sharing (CORS), a crucial security feature for modern web applications.

CORS allows web browsers to securely handle requests between a client-side application (like a Single-Page Application, SPA) and an API server when they're on different domains.

This is especially vital when your SPA uses OAuth2 or OpenID Connect to access protected resources.

To understand CORS, we first need to know about the Same-Origin Policy (SOP).

• SOP is a fundamental browser security feature.
• It prevents web pages from making requests to a different domain than the one that served the page.
• For example, a script from app.example.com cannot directly make an AJAX request to api.anothersite.com.

This protects users from malicious scripts trying to steal data from other sites you're logged into.