CORS (cross-origin resource sharing)
Headers that tell the browser which other websites may read responses from your API.
By default a script on one site cannot read responses from another origin. CORS relaxes that rule on purpose: the API answers with Access-Control-Allow-Origin and related headers, sometimes after a preflight OPTIONS request. It is enforced by browsers only, so it is not access control: a server or script outside the browser can still call the API.
Related terms
- CSRF (cross-site request forgery): Another site making a logged-in user’s browser send a request to your app, which the app trusts because the cookie came along.
- CSP (Content Security Policy): An HTTP header that tells the browser which scripts, styles and connections a page may use, limiting the damage of injected code.
- JWT (JSON Web Token): A signed, compact token that carries claims about a user, such as who they are and when the token expires.
