Lesson 04 · 9 min
CORS
The browser asks the server: "May this site read your responses?"
A page on app.example makes a request to api.example, a different origin. The browser sends it but hands the response to JavaScript only if the server replied with an Access-Control-Allow-Origin header naming that origin. For "complex" requests the browser first sends an OPTIONS preflight.
Sign in to continue
The rest of this lesson opens after sign up
The first lesson of every course is open without an account. To read on, solve the practice and use Ask, create a free account or log in.